From mboxrd@z Thu Jan 1 00:00:00 1970 From: maowenan Subject: Re: [PATCH stable 4.4 0/9] fix SegmentSmack (CVE-2018-5390) Date: Thu, 16 Aug 2018 09:20:41 +0800 Message-ID: <49f8091c-9034-33d8-1f36-571e1fd80aef@huawei.com> References: <1534339268-111834-1-git-send-email-maowenan@huawei.com> <20180815132432.GE31330@kroah.com> <20180815154131.GA12619@kroah.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Cc: , , , , , , To: Greg KH Return-path: Received: from szxga07-in.huawei.com ([45.249.212.35]:47746 "EHLO huawei.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726022AbeHPEPm (ORCPT ); Thu, 16 Aug 2018 00:15:42 -0400 In-Reply-To: <20180815154131.GA12619@kroah.com> Sender: netdev-owner@vger.kernel.org List-ID: On 2018/8/15 23:41, Greg KH wrote: > On Wed, Aug 15, 2018 at 03:24:32PM +0200, Greg KH wrote: >> On Wed, Aug 15, 2018 at 09:20:59PM +0800, Mao Wenan wrote: >>> There are five patches to fix CVE-2018-5390 in latest mainline >>> branch, but only two patches exist in stable 4.4 and 3.18: >>> dc6ae4d tcp: detect malicious patterns in tcp_collapse_ofo_queue() >>> 5fbec48 tcp: avoid collapses in tcp_prune_queue() if possible >>> but I have tested with these patches, and found the cpu usage was very high. >>> test results: >>> with fix patch： 78.2% ksoftirqd >>> no fix patch： 90% ksoftirqd >>> >>> After analysing the codes of stable 4.4, and debuging the >>> system, the search of ofo_queue(tcp ofo using a simple queue) cost more cycles. >>> So I think only two patches can't fix the CVE-2018-5390. >>> So I try to backport "tcp: use an RB tree for ooo receive queue" using RB tree >>> instead of simple queue, then backport Eric Dumazet 5 fixed patches in mainline, >>> good news is that ksoftirqd is turn to about 20%, which is the same with mainline now. >> >> Thanks for doing this work, I had some questions on the individual >> patches. Can you address them and resend? > > Also, always cc: the stable@vger list when sending stable patches so > that others can review and comment on them. ok,I will resend patches later after refining them. > > thanks, > > greg k-h > > . >