Exclude ACKs outside [SND.UNA, SND.NXT] from TCP header prediction so
that they fall through to the slow path, where ACK
validation is applied.

Add a packetdrill test for a data segment carrying an
excessively old ACK. The test fails on the unpatched kernel and passes
with the fix.

Changes in v2:

- Exclude all ACKs before SND.UNA from header prediction instead of
  duplicating old-ACK validation in the fast path.
- Cover pure ACKs as well as data-carrying segments.
- Let the existing slow path handle validation and challenge ACKs.
- Remove the packetdrill reproducer from the commit message; add the
  packetdrill test separately.

Inbal Schussheim (2):
  tcp: exclude old ACKs from tcp fast path
  selftests: net: packetdrill: test exclusion of old ACK from TCP fast
    path

 net/ipv4/tcp_input.c                          |  2 +-
 .../tcp_rfc5961_reject-old-ack.pkt            | 23 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/net/packetdrill/tcp_rfc5961_reject-old-ack.pkt

-- 
2.43.0

On Tue, Sep 8, 2026 at 12:38 PM Inbal Schussheim
<inbal.lipshtat@mail.huji.ac.il> wrote:
>
> Exclude ACKs outside [SND.UNA, SND.NXT] from TCP header prediction so
> that they fall through to the slow path, where ACK
> validation is applied.
>
> Add a packetdrill test for a data segment carrying an
> excessively old ACK. The test fails on the unpatched kernel and passes
> with the fix.
>
> Changes in v2:
>
> - Exclude all ACKs before SND.UNA from header prediction instead of
>   duplicating old-ACK validation in the fast path.
> - Cover pure ACKs as well as data-carrying segments.
> - Let the existing slow path handle validation and challenge ACKs.
> - Remove the packetdrill reproducer from the commit message; add the
>   packetdrill test separately.

OK but you forgot to CC netdev@vger.kernel.org and you forgot to tell
which tree you target.

Patches need to be sent to netdev@ (instead of lkml@) so that our CI
can run tests on them.

Please read Documentation/process/maintainer-netdev.rst for details.

Thanks.