Received: by 2002:ac0:8c9a:0:0:0:0:0 with SMTP id r26csp3670162ima; Mon, 4 Feb 2019 03:09:58 -0800 (PST) X-Google-Smtp-Source: AHgI3Ibd5VBaeLnUrRMxluAHIZgHyuvrkkyfGmm+VQORxFSas3fYmJ6VufBFt8kbB9yGt7Jfk3em X-Received: by 2002:a63:9712:: with SMTP id n18mr12373947pge.295.1549278598716; Mon, 04 Feb 2019 03:09:58 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1549278598; cv=none; d=google.com; s=arc-20160816; b=YiWWHzKW+ivzxrWY2BJ5PXM+A8JTO5CLf+Q+yoph+VY8F9uz0nwW9BcFLCeJYodzLc jbteH0Cl+JR6WQLFyF4lLm2nW23TvFh/1lXmDKJ33uWrX3iw/+tr5pGg9ho3f149/Qp4 vF6/1hzPTi0K1psVEAyC0hzAlDrk7RprmCPyGRDXWBJ/JD4EH0qsKUr/gxh3E7DkSEEc vPP9K1PGGAHENVmyD1PnFTpfHgFciIcJBqcZh7vndrrqP070BZZguRCxqVitC46e3Tc2 +4jDW9KRvKJDVW9O8kWkHqd8eqL9BWw4oIojeVNpbYwhJD3CbCD/uewq/AT6vA4IUFjl sv9Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=qh2e7IiO28efr31GYMCRoLU3ZlnZ7MS+6mYmz6r5KPc=; b=0GRK/tm5lODVR+bFpnVsC/aW3Xp8wyEZIjH6HpSxBMKBifN8O+0IZCUlce7gWZZ1fb D/gcLKPa+1k8B0YztMfpUVzns0AUqzDNxPgHRBNfKQ9KHsuSHc7TGLXh98Dicd7Tx9FX K1v9Uky9M2/y11fX9z//t6JRlyVdGf7azmU60XKzMjtgxtz3SiPFf5oMbg5N64Tdit7X Avj1nxM3EHVe6hmK22Znnxgt8k06g1XKegYN0s1SUd0LuRNv4+rJurT9fHkg4Y9KTRkg kRkjKizutZQahZsah8tBGFZeE+q+lBmJVAG7o/ZY3WchqA1iHJCNoU34uzMYqGv3PyZU XsQQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=EyjQMamb; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h36si4648317pgm.200.2019.02.04.03.09.42; Mon, 04 Feb 2019 03:09:58 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=EyjQMamb; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730984AbfBDLHl (ORCPT + 99 others); Mon, 4 Feb 2019 06:07:41 -0500 Received: from mail.kernel.org ([198.145.29.99]:40508 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729561AbfBDKmg (ORCPT ); Mon, 4 Feb 2019 05:42:36 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 71AF02070C; Mon, 4 Feb 2019 10:42:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1549276955; bh=sH/KUXA9nb6b7ECg35H8UiGMktKk+r911ADiV1ziOSk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EyjQMambnNNxJ82heWz6LT7aBtsFE0W6ooSRFiGMaIIsLC6mjfbMTnggTW2oyYY7v ALNhAzSomQkLtmCg9D9ABhJnYmrkHaRvdWfD1pnLxjxqPY0XyAeGPPjPVjTxDQc8fM UsqwhEh5AlirKNEGD5IyFwwsVbu+ENgNhtBWgR9s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michal Kubecek , "David S. Miller" , Mao Wenan Subject: [PATCH 4.4 63/65] net: ipv4: do not handle duplicate fragments as overlapping Date: Mon, 4 Feb 2019 11:36:56 +0100 Message-Id: <20190204103620.576394593@linuxfoundation.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190204103610.583715954@linuxfoundation.org> References: <20190204103610.583715954@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Michal Kubecek commit ade446403bfb79d3528d56071a84b15351a139ad upstream. Since commit 7969e5c40dfd ("ip: discard IPv4 datagrams with overlapping segments.") IPv4 reassembly code drops the whole queue whenever an overlapping fragment is received. However, the test is written in a way which detects duplicate fragments as overlapping so that in environments with many duplicate packets, fragmented packets may be undeliverable. Add an extra test and for (potentially) duplicate fragment, only drop the new fragment rather than the whole queue. Only starting offset and length are checked, not the contents of the fragments as that would be too expensive. For similar reason, linear list ("run") of a rbtree node is not iterated, we only check if the new fragment is a subset of the interval covered by existing consecutive fragments. v2: instead of an exact check iterating through linear list of an rbtree node, only check if the new fragment is subset of the "run" (suggested by Eric Dumazet) Fixes: 7969e5c40dfd ("ip: discard IPv4 datagrams with overlapping segments.") Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller Signed-off-by: Mao Wenan Signed-off-by: Greg Kroah-Hartman --- net/ipv4/ip_fragment.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) --- a/net/ipv4/ip_fragment.c +++ b/net/ipv4/ip_fragment.c @@ -400,10 +400,10 @@ static int ip_frag_queue(struct ipq *qp, struct net *net = container_of(qp->q.net, struct net, ipv4.frags); struct rb_node **rbn, *parent; struct sk_buff *skb1, *prev_tail; + int ihl, end, skb1_run_end; struct net_device *dev; unsigned int fragsize; int flags, offset; - int ihl, end; int err = -ENOENT; u8 ecn; @@ -473,7 +473,9 @@ static int ip_frag_queue(struct ipq *qp, * overlapping fragment, the entire datagram (and any constituent * fragments) MUST be silently discarded. * - * We do the same here for IPv4 (and increment an snmp counter). + * We do the same here for IPv4 (and increment an snmp counter) but + * we do not want to drop the whole queue in response to a duplicate + * fragment. */ /* Find out where to put this fragment. */ @@ -497,13 +499,17 @@ static int ip_frag_queue(struct ipq *qp, do { parent = *rbn; skb1 = rb_to_skb(parent); + skb1_run_end = FRAG_CB(skb1)->offset + + FRAG_CB(skb1)->frag_run_len; if (end <= FRAG_CB(skb1)->offset) rbn = &parent->rb_left; - else if (offset >= FRAG_CB(skb1)->offset + - FRAG_CB(skb1)->frag_run_len) + else if (offset >= skb1_run_end) rbn = &parent->rb_right; - else /* Found an overlap with skb1. */ - goto discard_qp; + else if (offset >= FRAG_CB(skb1)->offset && + end <= skb1_run_end) + goto err; /* No new data, potential duplicate */ + else + goto discard_qp; /* Found an overlap */ } while (*rbn); /* Here we have parent properly set, and rbn pointing to * one of its NULL left/right children. Insert skb.