+++ /dev/null
-commit 58152ecbbcc6a0ce7fddd5bf5f6ee535834ece0c
-Author: Eric Dumazet <edumazet@google.com>
-Date: Mon Jul 23 09:28:21 2018 -0700
-
- tcp: add tcp_ooo_try_coalesce() helper
-
- In case skb in out_or_order_queue is the result of
- multiple skbs coalescing, we would like to get a proper gso_segs
- counter tracking, so that future tcp_drop() can report an accurate
- number.
-
- I chose to not implement this tracking for skbs in receive queue,
- since they are not dropped, unless socket is disconnected.
-
- Signed-off-by: Eric Dumazet <edumazet@google.com>
- Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
- Acked-by: Yuchung Cheng <ycheng@google.com>
- Signed-off-by: David S. Miller <davem@davemloft.net>
-
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index b062a7692238..3bcd30a2ba06 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -4358,6 +4358,23 @@ static bool tcp_try_coalesce(struct sock *sk,
- return true;
- }
-
-+static bool tcp_ooo_try_coalesce(struct sock *sk,
-+ struct sk_buff *to,
-+ struct sk_buff *from,
-+ bool *fragstolen)
-+{
-+ bool res = tcp_try_coalesce(sk, to, from, fragstolen);
-+
-+ /* In case tcp_drop() is called later, update to->gso_segs */
-+ if (res) {
-+ u32 gso_segs = max_t(u16, 1, skb_shinfo(to)->gso_segs) +
-+ max_t(u16, 1, skb_shinfo(from)->gso_segs);
-+
-+ skb_shinfo(to)->gso_segs = min_t(u32, gso_segs, 0xFFFF);
-+ }
-+ return res;
-+}
-+
- static void tcp_drop(struct sock *sk, struct sk_buff *skb)
- {
- sk_drops_add(sk, skb);
-@@ -4481,8 +4498,8 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
- /* In the typical case, we are adding an skb to the end of the list.
- * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup.
- */
-- if (tcp_try_coalesce(sk, tp->ooo_last_skb,
-- skb, &fragstolen)) {
-+ if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb,
-+ skb, &fragstolen)) {
- coalesce_done:
- tcp_grow_window(sk, skb);
- kfree_skb_partial(skb, fragstolen);
-@@ -4532,8 +4549,8 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
- tcp_drop(sk, skb1);
- goto merge_right;
- }
-- } else if (tcp_try_coalesce(sk, skb1,
-- skb, &fragstolen)) {
-+ } else if (tcp_ooo_try_coalesce(sk, skb1,
-+ skb, &fragstolen)) {
- goto coalesce_done;
- }
- p = &parent->rb_right;
-commit 8541b21e781a22dce52a74fef0b9bed00404a1cd
-Author: Eric Dumazet <edumazet@google.com>
-Date: Mon Jul 23 09:28:20 2018 -0700
-
- tcp: call tcp_drop() from tcp_data_queue_ofo()
-
- In order to be able to give better diagnostics and detect
- malicious traffic, we need to have better sk->sk_drops tracking.
-
- Fixes: 9f5afeae5152 ("tcp: use an RB tree for ooo receive queue")
- Signed-off-by: Eric Dumazet <edumazet@google.com>
- Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
- Acked-by: Yuchung Cheng <ycheng@google.com>
- Signed-off-by: David S. Miller <davem@davemloft.net>
-
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 78068b902e7b..b062a7692238 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -4510,7 +4510,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
- /* All the bits are present. Drop. */
- NET_INC_STATS(sock_net(sk),
- LINUX_MIB_TCPOFOMERGE);
-- __kfree_skb(skb);
-+ tcp_drop(sk, skb);
- skb = NULL;
- tcp_dsack_set(sk, seq, end_seq);
- goto add_sack;
-@@ -4529,7 +4529,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
- TCP_SKB_CB(skb1)->end_seq);
- NET_INC_STATS(sock_net(sk),
- LINUX_MIB_TCPOFOMERGE);
-- __kfree_skb(skb1);
-+ tcp_drop(sk, skb1);
- goto merge_right;
- }
- } else if (tcp_try_coalesce(sk, skb1,
-commit 3d4bf93ac12003f9b8e1e2de37fe27983deebdcf
-Author: Eric Dumazet <edumazet@google.com>
-Date: Mon Jul 23 09:28:19 2018 -0700
-
- tcp: detect malicious patterns in tcp_collapse_ofo_queue()
-
- In case an attacker feeds tiny packets completely out of order,
- tcp_collapse_ofo_queue() might scan the whole rb-tree, performing
- expensive copies, but not changing socket memory usage at all.
-
- 1) Do not attempt to collapse tiny skbs.
- 2) Add logic to exit early when too many tiny skbs are detected.
-
- We prefer not doing aggressive collapsing (which copies packets)
- for pathological flows, and revert to tcp_prune_ofo_queue() which
- will be less expensive.
-
- In the future, we might add the possibility of terminating flows
- that are proven to be malicious.
-
- Signed-off-by: Eric Dumazet <edumazet@google.com>
- Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
- Signed-off-by: David S. Miller <davem@davemloft.net>
-
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 53289911362a..78068b902e7b 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -4902,6 +4902,7 @@ tcp_collapse(struct sock *sk, struct sk_buff_head *list, struct rb_root *root,
- static void tcp_collapse_ofo_queue(struct sock *sk)
- {
- struct tcp_sock *tp = tcp_sk(sk);
-+ u32 range_truesize, sum_tiny = 0;
- struct sk_buff *skb, *head;
- u32 start, end;
-
-@@ -4913,6 +4914,7 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
- }
- start = TCP_SKB_CB(skb)->seq;
- end = TCP_SKB_CB(skb)->end_seq;
-+ range_truesize = skb->truesize;
-
- for (head = skb;;) {
- skb = skb_rb_next(skb);
-@@ -4923,11 +4925,20 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
- if (!skb ||
- after(TCP_SKB_CB(skb)->seq, end) ||
- before(TCP_SKB_CB(skb)->end_seq, start)) {
-- tcp_collapse(sk, NULL, &tp->out_of_order_queue,
-- head, skb, start, end);
-+ /* Do not attempt collapsing tiny skbs */
-+ if (range_truesize != head->truesize ||
-+ end - start >= SKB_WITH_OVERHEAD(SK_MEM_QUANTUM)) {
-+ tcp_collapse(sk, NULL, &tp->out_of_order_queue,
-+ head, skb, start, end);
-+ } else {
-+ sum_tiny += range_truesize;
-+ if (sum_tiny > sk->sk_rcvbuf >> 3)
-+ return;
-+ }
- goto new_range;
- }
-
-+ range_truesize += skb->truesize;
- if (unlikely(before(TCP_SKB_CB(skb)->seq, start)))
- start = TCP_SKB_CB(skb)->seq;
- if (after(TCP_SKB_CB(skb)->end_seq, end))
-commit f4a3313d8e2ca9fd8d8f45e40a2903ba782607e7
-Author: Eric Dumazet <edumazet@google.com>
-Date: Mon Jul 23 09:28:18 2018 -0700
-
- tcp: avoid collapses in tcp_prune_queue() if possible
-
- Right after a TCP flow is created, receiving tiny out of order
- packets allways hit the condition :
-
- if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
- tcp_clamp_window(sk);
-
- tcp_clamp_window() increases sk_rcvbuf to match sk_rmem_alloc
- (guarded by tcp_rmem[2])
-
- Calling tcp_collapse_ofo_queue() in this case is not useful,
- and offers a O(N^2) surface attack to malicious peers.
-
- Better not attempt anything before full queue capacity is reached,
- forcing attacker to spend lots of resource and allow us to more
- easily detect the abuse.
-
- Signed-off-by: Eric Dumazet <edumazet@google.com>
- Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
- Acked-by: Yuchung Cheng <ycheng@google.com>
- Signed-off-by: David S. Miller <davem@davemloft.net>
-
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 64e45b279431..53289911362a 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -5004,6 +5004,9 @@ static int tcp_prune_queue(struct sock *sk)
- else if (tcp_under_memory_pressure(sk))
- tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss);
-
-+ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf)
-+ return 0;
-+
- tcp_collapse_ofo_queue(sk);
- if (!skb_queue_empty(&sk->sk_receive_queue))
- tcp_collapse(sk, &sk->sk_receive_queue, NULL,
-commit 72cd43ba64fc172a443410ce01645895850844c8
-Author: Eric Dumazet <edumazet@google.com>
-Date: Mon Jul 23 09:28:17 2018 -0700
-
- tcp: free batches of packets in tcp_prune_ofo_queue()
-
- Juha-Matti Tilli reported that malicious peers could inject tiny
- packets in out_of_order_queue, forcing very expensive calls
- to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for
- every incoming packet. out_of_order_queue rb-tree can contain
- thousands of nodes, iterating over all of them is not nice.
-
- Before linux-4.9, we would have pruned all packets in ofo_queue
- in one go, every XXXX packets. XXXX depends on sk_rcvbuf and skbs
- truesize, but is about 7000 packets with tcp_rmem[2] default of 6 MB.
-
- Since we plan to increase tcp_rmem[2] in the future to cope with
- modern BDP, can not revert to the old behavior, without great pain.
-
- Strategy taken in this patch is to purge ~12.5 % of the queue capacity.
-
- Fixes: 36a6503fedda ("tcp: refine tcp_prune_ofo_queue() to not drop all packets")
- Signed-off-by: Eric Dumazet <edumazet@google.com>
- Reported-by: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
- Acked-by: Yuchung Cheng <ycheng@google.com>
- Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
- Signed-off-by: David S. Miller <davem@davemloft.net>
-
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 6bade06aaf72..64e45b279431 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -4942,6 +4942,7 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
- * 2) not add too big latencies if thousands of packets sit there.
- * (But if application shrinks SO_RCVBUF, we could still end up
- * freeing whole queue here)
-+ * 3) Drop at least 12.5 % of sk_rcvbuf to avoid malicious attacks.
- *
- * Return true if queue has shrunk.
- */
-@@ -4949,20 +4950,26 @@ static bool tcp_prune_ofo_queue(struct sock *sk)
- {
- struct tcp_sock *tp = tcp_sk(sk);
- struct rb_node *node, *prev;
-+ int goal;
-
- if (RB_EMPTY_ROOT(&tp->out_of_order_queue))
- return false;
-
- NET_INC_STATS(sock_net(sk), LINUX_MIB_OFOPRUNED);
-+ goal = sk->sk_rcvbuf >> 3;
- node = &tp->ooo_last_skb->rbnode;
- do {
- prev = rb_prev(node);
- rb_erase(node, &tp->out_of_order_queue);
-+ goal -= rb_to_skb(node)->truesize;
- tcp_drop(sk, rb_to_skb(node));
-- sk_mem_reclaim(sk);
-- if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
-- !tcp_under_memory_pressure(sk))
-- break;
-+ if (!prev || goal <= 0) {
-+ sk_mem_reclaim(sk);
-+ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
-+ !tcp_under_memory_pressure(sk))
-+ break;
-+ goal = sk->sk_rcvbuf >> 3;
-+ }
- node = prev;
- } while (node);
- tp->ooo_last_skb = rb_to_skb(prev);
projects / packages / kernel.git / commitdiff