Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1223503 > unrolled thread
| Started by | Willy Tarreau <w@1wt.eu> |
|---|---|
| First post | 2015-09-13 01:30 +0200 |
| Last post | 2015-09-15 09:50 +0200 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
[PATCH 2.6.32 15/62] udp: fix behavior of wrong checksums Willy Tarreau <w@1wt.eu> - 2015-09-13 01:30 +0200
Re: [PATCH 2.6.32 15/62] udp: fix behavior of wrong checksums Ben Hutchings <ben@decadent.org.uk> - 2015-09-15 03:50 +0200
Re: [PATCH 2.6.32 15/62] udp: fix behavior of wrong checksums Willy Tarreau <w@1wt.eu> - 2015-09-15 09:50 +0200
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2015-09-13 01:30 +0200 |
| Subject | [PATCH 2.6.32 15/62] udp: fix behavior of wrong checksums |
| Message-ID | <q82p3-6WW-3@gated-at.bofh.it> |
2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet <edumazet@google.com> commit beb39db59d14990e401e235faf66a6b9b31240b0 upstream. We have two problems in UDP stack related to bogus checksums : 1) We return -EAGAIN to application even if receive queue is not empty. This breaks applications using edge trigger epoll() 2) Under UDP flood, we can loop forever without yielding to other processes, potentially hanging the host, especially on non SMP. This patch is an attempt to make things better. We might in the future add extra support for rt applications wanting to better control time spent doing a recv() in a hostile environment. For example we could validate checksums before queuing packets in socket receive queue. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk> CVE-2015-5364 Signed-off-by: Willy Tarreau <w@1wt.eu> --- net/ipv4/udp.c | 6 ++---- net/ipv6/udp.c | 6 ++---- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 0b2e07fb..3ae286b 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1016,10 +1016,8 @@ csum_copy_err: UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite); release_sock(sk); - if (noblock) - return -EAGAIN; - - /* starting over for a new packet */ + /* starting over for a new packet, but check if we need to yield */ + cond_resched(); msg->msg_flags &= ~MSG_TRUNC; goto try_again; } diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index d0367eb..0b023f3 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -301,10 +301,8 @@ csum_copy_err: } release_sock(sk); - if (noblock) - return -EAGAIN; - - /* starting over for a new packet */ + /* starting over for a new packet, but check if we need to yield */ + cond_resched(); msg->msg_flags &= ~MSG_TRUNC; goto try_again; } -- 1.7.12.2.21.g234cd45.dirty -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Ben Hutchings <ben@decadent.org.uk> |
|---|---|
| Date | 2015-09-15 03:50 +0200 |
| Message-ID | <q8NxD-763-3@gated-at.bofh.it> |
| In reply to | #1223503 |
On Sun, 2015-09-13 at 00:56 +0200, Willy Tarreau wrote: > 2.6.32-longterm review patch. If anyone has any objections, please let me know. > > ------------------ > > From: Eric Dumazet <edumazet@google.com> > > commit beb39db59d14990e401e235faf66a6b9b31240b0 upstream. > > We have two problems in UDP stack related to bogus checksums : > > 1) We return -EAGAIN to application even if receive queue is not empty. > This breaks applications using edge trigger epoll() > > 2) Under UDP flood, we can loop forever without yielding to other > processes, potentially hanging the host, especially on non SMP. > > This patch is an attempt to make things better. > > We might in the future add extra support for rt applications > wanting to better control time spent doing a recv() in a hostile > environment. For example we could validate checksums before queuing > packets in socket receive queue. > > Signed-off-by: Eric Dumazet <edumazet@google.com> > Cc: Willem de Bruijn <willemb@google.com> > Signed-off-by: David S. Miller <davem@davemloft.net> > Signed-off-by: Ben Hutchings <ben@decadent.org.uk> > > CVE-2015-5364 [...] As there were two different problems, each deserving its own CVE ID, this also fixes CVE-2015-5366. Ben. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Willy Tarreau <w@1wt.eu> |
|---|---|
| Date | 2015-09-15 09:50 +0200 |
| Message-ID | <q8Ta1-6M4-1@gated-at.bofh.it> |
| In reply to | #1224585 |
On Tue, Sep 15, 2015 at 02:44:31AM +0100, Ben Hutchings wrote: > As there were two different problems, each deserving its own CVE ID, > this also fixes CVE-2015-5366. Updated, thanks! willy -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web