Commit f070ef2a authored May 18, 2019 by Eric Dumazet Committed by David S. Miller Jun 15, 2019

tcp: tcp_fragment() should apply sane memory limits



Jonathan Looney reported that a malicious peer can force a sender
to fragment its retransmit queue into tiny skbs, inflating memory
usage and/or overflow 32bit counters.

TCP allows an application to queue up to sk_sndbuf bytes,
so we need to give some allowance for non malicious splitting
of retransmit queue.

A new SNMP counter is added to monitor how many times TCP
did not allow to split an skb if the allowance was exceeded.

Note that this counter might increase in the case applications
use SO_SNDBUF socket option to lower sk_sndbuf.

CVE-2019-11478 : tcp_fragment, prevent fragmenting a packet when the
	socket is already using more than half the allowed space

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Cc: Bruce Curtis <brucec@netflix.com>
Cc: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 3b4929f6

include/uapi/linux/snmp.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -283,6 +283,7 @@ enum
		LINUX_MIB_TCPACKCOMPRESSED, /* TCPAckCompressed */
		LINUX_MIB_TCPZEROWINDOWDROP, /* TCPZeroWindowDrop */
		LINUX_MIB_TCPRCVQDROP, /* TCPRcvQDrop */
		LINUX_MIB_TCPWQUEUETOOBIG, /* TCPWqueueTooBig */
		__LINUX_MIB_MAX
		};

net/ipv4/proc.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -287,6 +287,7 @@ static const struct snmp_mib snmp4_net_list[] = {
		SNMP_MIB_ITEM("TCPAckCompressed", LINUX_MIB_TCPACKCOMPRESSED),
		SNMP_MIB_ITEM("TCPZeroWindowDrop", LINUX_MIB_TCPZEROWINDOWDROP),
		SNMP_MIB_ITEM("TCPRcvQDrop", LINUX_MIB_TCPRCVQDROP),
		SNMP_MIB_ITEM("TCPWqueueTooBig", LINUX_MIB_TCPWQUEUETOOBIG),
		SNMP_MIB_SENTINEL
		};

net/ipv4/tcp_output.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -1296,6 +1296,11 @@ int tcp_fragment(struct sock *sk, enum tcp_queue tcp_queue,
		if (nsize < 0)
		nsize = 0;

		if (unlikely((sk->sk_wmem_queued >> 1) > sk->sk_sndbuf)) {
		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPWQUEUETOOBIG);
		return -ENOMEM;
		}

		if (skb_unclone(skb, gfp))
		return -ENOMEM;

Admin message