From: Sasha Levin <sashal@kernel.org>
To: Captain Wiggum <captwiggum@gmail.com>, davem@davemloft.net
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Florian Westphal <fw@strlen.de>,
Eric Dumazet <edumazet@google.com>,
Peter Oskolkov <posk@google.com>,
netdev@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH net] ipv6: un-do: defrag: drop non-last frags smaller than min mtu
Date: Sat, 6 Apr 2019 10:15:10 -0400 [thread overview]
Message-ID: <20190406141510.GC2935@sasha-vm> (raw)
In-Reply-To: <CAB=W+omWW+C3yLvSL9KGHc=+O4-S9oXFpjkpRNZ3GQPP29egUA@mail.gmail.com>
On Fri, Apr 05, 2019 at 10:22:51AM -0600, Captain Wiggum wrote:
>I know it affects 4.9, 4.14, 4.19.
>I have not tested the older LTS kernels.
>But any LTS kernel that previously received this commit is affected:
>... commit a8444b1ccb20339774af58e40ad42296074fb484
>... ipv6: defrag: drop non-last frags smaller than min mtu
>
>
>
>On Thu, Apr 4, 2019 at 10:50 PM Greg Kroah-Hartman
><gregkh@linuxfoundation.org> wrote:
>>
>> On Thu, Apr 04, 2019 at 06:18:30PM -0600, Captain Wiggum wrote:
>> > Hi Greg,
>> >
>> > A previous bad patch breaks 18 test cases for IPv6 fragment headers.
>> > This has already been un-done in upstream, but not in any of the LTS.
>> > However two upstream patches are first needed to cover a DoS vulnerability.
>> >
>> > For background, there are two mail threads in [netdev] on this subject:
>> > 1) Subject: TAHI testing fails for IPv6 Fragments in Kernel 4.9 (from
>> > captwiggum)
>> > 2) Subject: Please merge IPv6 fix for drop fragment smaller than MTU
>> > (from captwiggum)
>> >
>> > Two patches from upstream needed first to cover the DoS:
>> >
>> > commit d4289fcc9b16b89619ee1c54f829e05e56de8b9a
>> > net: IP6 defrag: use rbtrees for IPv6 defrag
>> >
>> > commit 997dd96471641e147cb2c33ad54284000d0f5e35
>> > net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c
>> >
>> > One undo-patch to fix the IPv6 fragment headers:
>> >
>> > ipv6: defrag: drop non-last frags smaller than min mtu
>> > UN-DO: commit a8444b1ccb20339774af58e40ad42296074fb484
>>
>> For what kernel version(s) do these patches need to be applied?
>>
>> thanks,
>>
>> greg k-h
I see that 0ed4229b08c1 ("ipv6: defrag: drop non-last frags smaller than
min mtu") wasn't reverted upstream, why is a revert needed on the stable
trees?
David, could you ack these requests?
--
Thanks,
Sasha
next prev parent reply other threads:[~2019-04-06 14:15 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-05 0:18 [PATCH net] ipv6: un-do: defrag: drop non-last frags smaller than min mtu Captain Wiggum
2019-04-05 4:50 ` Greg Kroah-Hartman
2019-04-05 16:22 ` Captain Wiggum
2019-04-06 14:15 ` Sasha Levin [this message]
2019-04-06 16:34 ` Florian Westphal
2019-04-08 14:49 ` Captain Wiggum
2019-04-08 14:54 ` Eric Dumazet
2019-04-08 15:09 ` Captain Wiggum
2019-04-08 15:51 ` Sasha Levin
2019-04-08 15:59 ` Peter Oskolkov
2019-04-08 16:29 ` Captain Wiggum
2019-04-08 17:13 ` Peter Oskolkov
2019-04-08 23:15 ` Sasha Levin
2019-04-08 23:38 ` Peter Oskolkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190406141510.GC2935@sasha-vm \
--to=sashal@kernel.org \
--cc=captwiggum@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=fw@strlen.de \
--cc=gregkh@linuxfoundation.org \
--cc=netdev@vger.kernel.org \
--cc=posk@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.