From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.5 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS, USER_AGENT_MUTT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 41716C10F0F for ; Fri, 5 Apr 2019 04:50:51 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0D73C21872 for ; Fri, 5 Apr 2019 04:50:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1554439851; bh=8MouipqdFzF9golcIbiqAU8m6ExlvKHtlj5n3PvJnhs=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=GjXWQKtvDyslfONFv7cp+VaUFffBvjo1xckhvugTbf8+ezXFvurkA1S6JRJVQAnX0 SNZBX5Jm8pfb99TUinxqbgwt9j9q25wtohOYU7ETGdYJJH0vf+JszIVRevl9YP1pxX UxC5OAHiDNU7048ABRn9W+AADRuUSW/cv8dQ36VU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726643AbfDEEuu (ORCPT ); Fri, 5 Apr 2019 00:50:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:60260 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725955AbfDEEut (ORCPT ); Fri, 5 Apr 2019 00:50:49 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DA3192184B; Fri, 5 Apr 2019 04:50:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1554439849; bh=8MouipqdFzF9golcIbiqAU8m6ExlvKHtlj5n3PvJnhs=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=QuVFyvd7rV5yn8voN7k3ZWhgwf1wigJfYk3nGfWNdkuhbKPcB9lYiYRaJIKWqJ9DP hhPSYkAn50lW1UpDNuXbNpYNvAXThKpCj7F0kqO6CyngS5K6QsnyCFcH8sPnx76GSa uwNGlpcXFshddCU+bDacYlWbbO9mXlJ8TMVswHY4= Date: Fri, 5 Apr 2019 06:50:47 +0200 From: Greg Kroah-Hartman To: Captain Wiggum Cc: Florian Westphal , Eric Dumazet , Peter Oskolkov , netdev@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH net] ipv6: un-do: defrag: drop non-last frags smaller than min mtu Message-ID: <20190405045047.GB553@kroah.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.4 (2019-03-13) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Thu, Apr 04, 2019 at 06:18:30PM -0600, Captain Wiggum wrote: > Hi Greg, > > A previous bad patch breaks 18 test cases for IPv6 fragment headers. > This has already been un-done in upstream, but not in any of the LTS. > However two upstream patches are first needed to cover a DoS vulnerability. > > For background, there are two mail threads in [netdev] on this subject: > 1) Subject: TAHI testing fails for IPv6 Fragments in Kernel 4.9 (from > captwiggum) > 2) Subject: Please merge IPv6 fix for drop fragment smaller than MTU > (from captwiggum) > > Two patches from upstream needed first to cover the DoS: > > commit d4289fcc9b16b89619ee1c54f829e05e56de8b9a > net: IP6 defrag: use rbtrees for IPv6 defrag > > commit 997dd96471641e147cb2c33ad54284000d0f5e35 > net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c > > One undo-patch to fix the IPv6 fragment headers: > > ipv6: defrag: drop non-last frags smaller than min mtu > UN-DO: commit a8444b1ccb20339774af58e40ad42296074fb484 For what kernel version(s) do these patches need to be applied? thanks, greg k-h