[PATCH 3.16 327/370] net: avoid sk_forward_alloc overflows

Path	csiph.com!aioe.org!news.servidellagleba.it!bofh.it!news.nic.it!robomod
From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	[PATCH 3.16 327/370] net: avoid sk_forward_alloc overflows
Date	Fri, 10 Mar 2017 14:30:03 +0100
Message-ID	<tjsMj-4Ar-55@gated-at.bofh.it> (permalink)
References	<tjrnb-3sF-3@gated-at.bofh.it>
X-Original-To	linux-kernel@vger.kernel.org, stable@vger.kernel.org
Content-Type	text/plain; charset="UTF-8"
Content-Disposition	inline
Content-Transfer-Encoding	8bit
MIME-Version	1.0
X-Mailer	LinuxStableQueue (scripts by bwh)
X-Sa-Exim-Connect-IP	82.70.136.246
X-Sa-Exim-Mail-From	ben@decadent.org.uk
X-Sa-Exim-Scanned	No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	53
Organization	linux.* mail to news gateway
X-Original-Cc	akpm@linux-foundation.org, "David S. Miller" <davem@davemloft.net>, "Eric Dumazet" <edumazet@google.com>
X-Original-Date	Fri, 10 Mar 2017 11:46:23 +0000
X-Original-Message-ID	<lsq.1489146383.3532115@decadent.org.uk>
X-Original-References	<lsq.1489146380.780052105@decadent.org.uk>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1597585

Show key headers only | View raw

3.16.42-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Eric Dumazet <edumazet@google.com>

[ Upstream commit 20c64d5cd5a2bdcdc8982a06cb05e5e1bd851a3d ]

A malicious TCP receiver, sending SACK, can force the sender to split
skbs in write queue and increase its memory usage.

Then, when socket is closed and its write queue purged, we might
overflow sk_forward_alloc (It becomes negative)

sk_mem_reclaim() does nothing in this case, and more than 2GB
are leaked from TCP perspective (tcp_memory_allocated is not changed)

Then warnings trigger from inet_sock_destruct() and
sk_stream_kill_queues() seeing a not zero sk_forward_alloc

All TCP stack can be stuck because TCP is under memory pressure.

A simple fix is to preemptively reclaim from sk_mem_uncharge().

This makes sure a socket wont have more than 2 MB forward allocated,
after burst and idle period.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 include/net/sock.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1475,6 +1475,16 @@ static inline void sk_mem_uncharge(struc
 	if (!sk_has_account(sk))
 		return;
 	sk->sk_forward_alloc += size;
+
+	/* Avoid a possible overflow.
+	 * TCP send queues can make this happen, if sk_mem_reclaim()
+	 * is not called and more than 2 GBytes are released at once.
+	 *
+	 * If we reach 2 MBytes, reclaim 1 MBytes right now, there is
+	 * no need to hold that much forward allocation anyway.
+	 */
+	if (unlikely(sk->sk_forward_alloc >= 1 << 21))
+		__sk_mem_reclaim(sk, 1 << 20);
 }
 
 static inline void sk_wmem_free_skb(struct sock *sk, struct sk_buff *skb)

Back to linux.kernel | Previous | Next | Find similar | Unroll thread

Thread

[PATCH 3.16 327/370] net: avoid sk_forward_alloc overflows Ben Hutchings <ben@decadent.org.uk> - 2017-03-10 14:30 +0100

csiph-web