From: Willy Tarreau <w@1wt.eu>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
David Miller <davem@davemloft.net>
Cc: Eric Dumazet <eric.dumazet@gmail.com>,
netdev@vger.kernel.org, stable@vger.kernel.org
Subject: for 3.0 : please add "c16a98e ipv6: tcp: fix panic in SYN processing"
Date: Fri, 18 Oct 2013 16:04:42 +0200 [thread overview]
Message-ID: <20131018140442.GA16883@1wt.eu> (raw)
Greg, David,
one of our customers faced a panic in latest 2.6.32 when both somaxconn
and the listen backlog are large on an IPv6 socket. It was also reported
by one haproxy user on the latest RHEL6 kernel a few months ago. We found
that the same bug affects 3.0 up to and including 3.0.100.
Eric had already spotted that bug and fixed it in 3.2 with the following
patch :
commit c16a98ed91597b40b22b540c6517103497ef8e74
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date: Wed Nov 23 15:49:31 2011 -0500
ipv6: tcp: fix panic in SYN processing
commit 72a3effaf633bc ([NET]: Size listen hash tables using backlog
hint) added a bug allowing inet6_synq_hash() to return an out of bound
array index, because of u16 overflow.
Bug can happen if system admins set net.core.somaxconn &
net.ipv4.tcp_max_syn_backlog sysctls to values greater than 65536
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
In practice, the bug extends to lower values as well (32768 and above),
because reqsk_queue_alloc() can round the number of entries to double of
the backlog by doing roundup_pow_of_two(backlog+1), resulting in
inet6_csk_search_req() calling inet6_synq_hash() with too large an integer.
Could we please apply it to 3.0 before it finishes its life ?
Thanks,
Willy
next reply other threads:[~2013-10-18 14:04 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-10-18 14:04 Willy Tarreau [this message]
2013-10-18 14:34 ` for 3.0 : please add "c16a98e ipv6: tcp: fix panic in SYN processing" Greg Kroah-Hartman
2013-10-18 17:31 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20131018140442.GA16883@1wt.eu \
--to=w@1wt.eu \
--cc=davem@davemloft.net \
--cc=eric.dumazet@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).