blob: 55870561945e7121fe8c0532ad80c7a02bf598d6 [file] [log] [blame]
From 58b5fda5d311d84e1123c25c22430960eb4a2506 Mon Sep 17 00:00:00 2001
From: Eric Dumazet <>
Date: Wed, 12 Jun 2019 09:52:31 -0700
Subject: [PATCH] net/packet: implement shortcut in tpacket_rcv()
commit 2c51c6273c73ff04099f48fb42dfdd2acc7a1b70 upstream.
tpacket_rcv() can be hit under DDOS quite hard, since
it will always grab a socket spinlock, to eventually find
there is no room for an additional packet.
Using tcpdump [1] on a busy host can lead to catastrophic consequences,
because of all cpus spinning on a contended spinlock.
This replicates a similar strategy used in packet_rcv()
[1] Also some applications mistakenly use af_packet socket
bound to ETH_P_ALL only to send packets.
Receive queue is never drained and immediately full.
Signed-off-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Paul Gortmaker <>
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 1b42badb40f1..beb6770c1bec 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2202,6 +2202,12 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
if (!res)
goto drop_n_restore;
+ /* If we are flooded, just give up */
+ if (__packet_rcv_has_room(po, skb) == ROOM_NONE) {
+ atomic_inc(&po->tp_drops);
+ goto drop_n_restore;
+ }
if (skb->ip_summed == CHECKSUM_PARTIAL)
else if (skb->pkt_type != PACKET_OUTGOING &&