Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a87ec92 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

inet: frags: do not clone skb in ip_expire() 



An skb_clone() was added in commit ec4fbd64751d ("inet: frag: release
spinlock before calling icmp_send()")

While fixing the bug at that time, it also added a very high cost
for DDOS frags, as the ICMP rate limit is applied after this
expensive operation (skb_clone() + consume_skb(), implying memory
allocations, copy, and freeing)

We can use skb_get(head) here, all we want is to make sure skb wont
be freed by another cpu.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
(cherry picked from commit 1eec5d5670084ee644597bd26c25e22c69b9f748)
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7f617068

net/ipv4/ip_fragment.c

+6 −10
Original line number Diff line number Diff line
@@ -141,8 +141,8 @@ static bool frag_expire_skip_icmp(u32 user) 
 */

static void ip_expire(unsigned long arg)

{

	struct sk_buff *clone, *head;

	const struct iphdr *iph;

	struct sk_buff *head;

	struct net *net;

	struct ipq *qp;

	int err;
@@ -185,16 +185,12 @@ static void ip_expire(unsigned long arg) 
	    (skb_rtable(head)->rt_type != RTN_LOCAL))

		goto out;



	clone = skb_clone(head, GFP_ATOMIC);



	/* Send an ICMP "Fragment Reassembly Timeout" message. */

	if (clone) {

	skb_get(head);

	spin_unlock(&qp->q.lock);

		icmp_send(clone, ICMP_TIME_EXCEEDED,

			  ICMP_EXC_FRAGTIME, 0);

		consume_skb(clone);

	icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);

	kfree_skb(head);

	goto out_rcu_unlock;

	}



out:

	spin_unlock(&qp->q.lock);

out_rcu_unlock: