Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 02324a28 authored by Eric Dumazet's avatar Eric Dumazet Committed by Sharath Chandra Vurukala
Browse files

tcp: free batches of packets in tcp_prune_ofo_queue() 



[ Upstream commit 72cd43ba64fc172a443410ce01645895850844c8 ]

Juha-Matti Tilli reported that malicious peers could inject tiny
packets in out_of_order_queue, forcing very expensive calls
to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for
every incoming packet. out_of_order_queue rb-tree can contain
thousands of nodes, iterating over all of them is not nice.

Before linux-4.9, we would have pruned all packets in ofo_queue
in one go, every XXXX packets. XXXX depends on sk_rcvbuf and skbs
truesize, but is about 7000 packets with tcp_rmem[2] default of 6 MB.

Since we plan to increase tcp_rmem[2] in the future to cope with
modern BDP, can not revert to the old behavior, without great pain.

Strategy taken in this patch is to purge ~12.5 % of the queue capacity.

Change-Id: Ibb7318dc958c5795d22a5001aa4a64ee38fd823b
Fixes: 36a6503f ("tcp: refine tcp_prune_ofo_queue() to not drop all packets")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarJuha-Matti Tilli <juha-matti.tilli@iki.fi>
Acked-by: default avatarYuchung Cheng <ycheng@google.com>
Acked-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Git-commit: 2b4dbcd9
Git-repo: https://android.googlesource.com/kernel/common/


Signed-off-by: default avatarSharath Chandra Vurukala <sharathv@codeaurora.org>
parent 6fec52c1

include/linux/skbuff.h

+2 −0
Original line number Diff line number Diff line
@@ -2986,6 +2986,8 @@ static inline int __skb_grow_rcsum(struct sk_buff *skb, unsigned int len) 
	return __skb_grow(skb, len);

}



#define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode)



#define skb_queue_walk(queue, skb) \

		for (skb = (queue)->next;					\

		     skb != (struct sk_buff *)(queue);				\

net/ipv4/tcp_input.c

+11 −4
Original line number Diff line number Diff line
@@ -4956,6 +4956,7 @@ static void tcp_collapse_ofo_queue(struct sock *sk) 
 * 2) not add too big latencies if thousands of packets sit there.

 *    (But if application shrinks SO_RCVBUF, we could still end up

 *     freeing whole queue here)

 * 3) Drop at least 12.5 % of sk_rcvbuf to avoid malicious attacks.

 *

 * Return true if queue has shrunk.

 */
@@ -4963,20 +4964,26 @@ static bool tcp_prune_ofo_queue(struct sock *sk) 
{

	struct tcp_sock *tp = tcp_sk(sk);

	struct rb_node *node, *prev;

	int goal;



	if (RB_EMPTY_ROOT(&tp->out_of_order_queue))

		return false;



	NET_INC_STATS(sock_net(sk), LINUX_MIB_OFOPRUNED);

	goal = sk->sk_rcvbuf >> 3;

	node = &tp->ooo_last_skb->rbnode;

	do {

		prev = rb_prev(node);

		rb_erase(node, &tp->out_of_order_queue);

		goal -= rb_to_skb(node)->truesize;

		tcp_drop(sk, rb_entry(node, struct sk_buff, rbnode));

		if (!prev || goal <= 0) {

			sk_mem_reclaim(sk);

			if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&

			    !tcp_under_memory_pressure(sk))

				break;

			goal = sk->sk_rcvbuf >> 3;

		}

		node = prev;

	} while (node);

	tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode);