From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755872AbbILXTn (ORCPT ); Sat, 12 Sep 2015 19:19:43 -0400 Received: from wtarreau.pck.nerim.net ([62.212.114.60]:9285 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754978AbbILXMh (ORCPT ); Sat, 12 Sep 2015 19:12:37 -0400 Message-Id: <20150912225607.214241293@1wt.eu> User-Agent: quilt/0.63-1 Date: Sun, 13 Sep 2015 00:56:21 +0200 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Eric Dumazet , Willem de Bruijn , "David S. Miller" , Ben Hutchings , Willy Tarreau Subject: [PATCH 2.6.32 15/62] udp: fix behavior of wrong checksums MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <08d3b586eb2e764308c3de9ee398a17c@local> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet commit beb39db59d14990e401e235faf66a6b9b31240b0 upstream. We have two problems in UDP stack related to bogus checksums : 1) We return -EAGAIN to application even if receive queue is not empty. This breaks applications using edge trigger epoll() 2) Under UDP flood, we can loop forever without yielding to other processes, potentially hanging the host, especially on non SMP. This patch is an attempt to make things better. We might in the future add extra support for rt applications wanting to better control time spent doing a recv() in a hostile environment. For example we could validate checksums before queuing packets in socket receive queue. Signed-off-by: Eric Dumazet Cc: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings CVE-2015-5364 Signed-off-by: Willy Tarreau --- net/ipv4/udp.c | 6 ++---- net/ipv6/udp.c | 6 ++---- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 0b2e07fb..3ae286b 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1016,10 +1016,8 @@ csum_copy_err: UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite); release_sock(sk); - if (noblock) - return -EAGAIN; - - /* starting over for a new packet */ + /* starting over for a new packet, but check if we need to yield */ + cond_resched(); msg->msg_flags &= ~MSG_TRUNC; goto try_again; } diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index d0367eb..0b023f3 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -301,10 +301,8 @@ csum_copy_err: } release_sock(sk); - if (noblock) - return -EAGAIN; - - /* starting over for a new packet */ + /* starting over for a new packet, but check if we need to yield */ + cond_resched(); msg->msg_flags &= ~MSG_TRUNC; goto try_again; } -- 1.7.12.2.21.g234cd45.dirty