tcp: tcp_fragment() should apply sane memory limits
authorEric Dumazet <edumazet@google.com>
Sat, 18 May 2019 12:12:05 +0000 (05:12 -0700)
committerDavid S. Miller <davem@davemloft.net>
Sun, 16 Jun 2019 01:47:31 +0000 (18:47 -0700)
commitf070ef2ac66716357066b683fb0baf55f8191a2e
tree1ae8c5a4c6c989a13cf77c4e1d09754756f1cc2c
parent3b4929f65b0d8249f19a50245cd88ed1a2f78cff
tcp: tcp_fragment() should apply sane memory limits

Jonathan Looney reported that a malicious peer can force a sender
to fragment its retransmit queue into tiny skbs, inflating memory
usage and/or overflow 32bit counters.

TCP allows an application to queue up to sk_sndbuf bytes,
so we need to give some allowance for non malicious splitting
of retransmit queue.

A new SNMP counter is added to monitor how many times TCP
did not allow to split an skb if the allowance was exceeded.

Note that this counter might increase in the case applications
use SO_SNDBUF socket option to lower sk_sndbuf.

CVE-2019-11478 : tcp_fragment, prevent fragmenting a packet when the
socket is already using more than half the allowed space

Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Jonathan Looney <jtl@netflix.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Reviewed-by: Tyler Hicks <tyhicks@canonical.com>
Cc: Bruce Curtis <brucec@netflix.com>
Cc: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/uapi/linux/snmp.h
net/ipv4/proc.c
net/ipv4/tcp_output.c