Received: by 10.223.185.111 with SMTP id b44csp918557wrg; Fri, 9 Mar 2018 16:51:09 -0800 (PST) X-Google-Smtp-Source: AG47ELt4Vz+pPpc5jaKGhTs1AOBOxBD29vjG2cYL1p09l39KNN19KnuH1/BmREFIrriS1KjRLuv2 X-Received: by 10.101.73.139 with SMTP id r11mr333102pgs.322.1520643069604; Fri, 09 Mar 2018 16:51:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1520643069; cv=none; d=google.com; s=arc-20160816; b=hFgAeFvTt7MYySB56eruTHuLZuU8vWnBheemLS36H7AE2SWalH5qSJvAqC1DBMz++a +m2eXln9+pHCDeR0B7HZIV0RE4n13+kh+nZA59RX43WzJj2LDua+whudXQT6R+P4lu/H UXXjexcMbczrXalViSGw38fJTMLVZpfbkcjKAS+XLds0DiwrAWTwSeyJEevY6gGs+/DQ Y7wrMfLJjiCTnEW1JYQ3XWfFdD1hmE08XDdK4izzlRHesJ18ctd8cc1/zBQyKwxbTBk6 mJ9+k5RH3Xbwu7duenZFbcRQSsLd8qsy7nbhdkP9EUoqkjQ48pQ7RJk4dYU14YUUdiMo lhyg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=tRKndvsJxnI8vCZJkO4ZuTxhY8qIoWTfzhPvGDqMb8U=; b=Slr9eGGQv0e425i65xRaXFwyZEGpm/48F4u5PklAOboacKlSUsDYXATDuTkxWP1Hh0 mgNu8CbE/vQzLTPaeOq50sDc+sMw+ogsfN/7xo07H8Vc5OUIkOXye92Ipkunrr7BZER5 M+20457jRaYy0XzuAG66XKLxSCPAWO6t27/I4Oyrt1seEC5UZvSiMAVljGZQ+QhDisV+ wAcxuVZ+m8TwV9+ZNVd9ruWWbRNx+egc/0jTg4ShfwjSCBx49pHe49KTkLi2PM+LIPuT wR2OI18qiHDMLfArugFBZ2uE/KiIZDpvc1EJ3EGO7pUAt9nFnVYehmpeybxPHbc2pNZW CyYA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id s18si1518985pgd.65.2018.03.09.16.50.54; Fri, 09 Mar 2018 16:51:09 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933196AbeCJAuB (ORCPT + 99 others); Fri, 9 Mar 2018 19:50:01 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:38652 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932528AbeCJAT0 (ORCPT ); Fri, 9 Mar 2018 19:19:26 -0500 Received: from localhost (unknown [185.236.200.248]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id EA1EFF1E; Sat, 10 Mar 2018 00:19:25 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jianlin Shi , Sabrina Dubroca , Stefano Brivio , "David S. Miller" Subject: [PATCH 3.18 19/21] net: ipv4: dont allow setting net.ipv4.route.min_pmtu below 68 Date: Fri, 9 Mar 2018 16:18:41 -0800 Message-Id: <20180310001802.292238473@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180310001801.045114869@linuxfoundation.org> References: <20180310001801.045114869@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sabrina Dubroca [ Upstream commit c7272c2f1229125f74f22dcdd59de9bbd804f1c8 ] According to RFC 1191 sections 3 and 4, ICMP frag-needed messages indicating an MTU below 68 should be rejected: A host MUST never reduce its estimate of the Path MTU below 68 octets. and (talking about ICMP frag-needed's Next-Hop MTU field): This field will never contain a value less than 68, since every router "must be able to forward a datagram of 68 octets without fragmentation". Furthermore, by letting net.ipv4.route.min_pmtu be set to negative values, we can end up with a very large PMTU when (-1) is cast into u32. Let's also make ip_rt_min_pmtu a u32, since it's only ever compared to unsigned ints. Reported-by: Jianlin Shi Signed-off-by: Sabrina Dubroca Reviewed-by: Stefano Brivio Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/route.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -122,9 +122,11 @@ static int ip_rt_redirect_silence __read static int ip_rt_error_cost __read_mostly = HZ; static int ip_rt_error_burst __read_mostly = 5 * HZ; static int ip_rt_mtu_expires __read_mostly = 10 * 60 * HZ; -static int ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; +static u32 ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; static int ip_rt_min_advmss __read_mostly = 256; +static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU; + /* * Interface to generic destination cache. */ @@ -2629,7 +2631,8 @@ static struct ctl_table ipv4_route_table .data = &ip_rt_min_pmtu, .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_dointvec, + .proc_handler = proc_dointvec_minmax, + .extra1 = &ip_min_valid_pmtu, }, { .procname = "min_adv_mss",