| From foo@baz Mon Sep 17 13:33:56 CEST 2018 |
| From: Stephen Hemminger <stephen@networkplumber.org> |
| Date: Thu, 13 Sep 2018 07:58:46 -0700 |
| Subject: inet: frags: do not clone skb in ip_expire() |
| To: davem@davemloft.net, gregkh@linuxfoundation.org |
| Cc: netdev@vger.kernel.org, stable@vger.kernel.org, edumazet@google.com |
| Message-ID: <20180913145902.17531-15-sthemmin@microsoft.com> |
| |
| From: Eric Dumazet <edumazet@google.com> |
| |
| An skb_clone() was added in commit ec4fbd64751d ("inet: frag: release |
| spinlock before calling icmp_send()") |
| |
| While fixing the bug at that time, it also added a very high cost |
| for DDOS frags, as the ICMP rate limit is applied after this |
| expensive operation (skb_clone() + consume_skb(), implying memory |
| allocations, copy, and freeing) |
| |
| We can use skb_get(head) here, all we want is to make sure skb wont |
| be freed by another cpu. |
| |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| (cherry picked from commit 1eec5d5670084ee644597bd26c25e22c69b9f748) |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/ipv4/ip_fragment.c | 16 ++++++---------- |
| 1 file changed, 6 insertions(+), 10 deletions(-) |
| |
| --- a/net/ipv4/ip_fragment.c |
| +++ b/net/ipv4/ip_fragment.c |
| @@ -143,8 +143,8 @@ static bool frag_expire_skip_icmp(u32 us |
| static void ip_expire(struct timer_list *t) |
| { |
| struct inet_frag_queue *frag = from_timer(frag, t, timer); |
| - struct sk_buff *clone, *head; |
| const struct iphdr *iph; |
| + struct sk_buff *head; |
| struct net *net; |
| struct ipq *qp; |
| int err; |
| @@ -187,16 +187,12 @@ static void ip_expire(struct timer_list |
| (skb_rtable(head)->rt_type != RTN_LOCAL)) |
| goto out; |
| |
| - clone = skb_clone(head, GFP_ATOMIC); |
| + skb_get(head); |
| + spin_unlock(&qp->q.lock); |
| + icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); |
| + kfree_skb(head); |
| + goto out_rcu_unlock; |
| |
| - /* Send an ICMP "Fragment Reassembly Timeout" message. */ |
| - if (clone) { |
| - spin_unlock(&qp->q.lock); |
| - icmp_send(clone, ICMP_TIME_EXCEEDED, |
| - ICMP_EXC_FRAGTIME, 0); |
| - consume_skb(clone); |
| - goto out_rcu_unlock; |
| - } |
| out: |
| spin_unlock(&qp->q.lock); |
| out_rcu_unlock: |
