From mboxrd@z Thu Jan 1 00:00:00 1970 From: maowenan Subject: Re: [PATCH stable 4.4 0/9] fix SegmentSmack in stable branch (CVE-2018-5390) Date: Thu, 16 Aug 2018 15:39:14 +0800 Message-ID: <827465d9-4116-68a8-c699-d5b2aedce69f@huawei.com> References: <1534387810-121428-1-git-send-email-maowenan@huawei.com> <20180816061621.imodnhlytllvnlkj@unicorn.suse.cz> <20180816065210.iq7jyscajjoiw7k4@unicorn.suse.cz> <20180816072349.2ldy75jia3ubqg3u@unicorn.suse.cz> Mime-Version: 1.0 Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit Cc: , , , , , , , , , Takashi Iwai To: Michal Kubecek Return-path: In-Reply-To: <20180816072349.2ldy75jia3ubqg3u@unicorn.suse.cz> Sender: stable-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On 2018/8/16 15:23, Michal Kubecek wrote: > On Thu, Aug 16, 2018 at 03:19:12PM +0800, maowenan wrote: >> On 2018/8/16 14:52, Michal Kubecek wrote: >>> >>> My point is that backporting all this into stable 4.4 is quite intrusive >>> so that if we can achieve similar results with a simple fix of an >>> obvious omission, it would be preferrable. >> >> There are five patches in mainline to fix this CVE, only two patches >> have no effect on stable 4.4, the important reason is 4.4 use simple >> queue but mainline use RB tree. >> >> I have tried my best to use easy way to fix this with dropping packets >> 12.5%(or other value) based on simple queue, but the result is not >> very well, so the RB tree is needed and tested result is my desire. >> >> If we only back port two patches but they don't fix the issue, I think >> they don't make any sense. > > There is an obvious omission in one of the two patches and Takashi's > patch fixes it. If his follow-up fix (applied on top of what is in > stable 4.4 now) addresses the problem, I would certainly prefer using it > over backporting the whole series. Do you mean below codes from Takashi can fix this CVE? But I have already tested like this two days ago, it is not good effect. Could you try to test with POC programme mentioned previous mail in case I made mistake? diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 4a261e078082..9c4c6cd0316e 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -4835,6 +4835,7 @@ static void tcp_collapse_ofo_queue(struct sock *sk) end = TCP_SKB_CB(skb)->end_seq; range_truesize = skb->truesize; } else { + range_truesize += skb->truesize; if (before(TCP_SKB_CB(skb)->seq, start)) start = TCP_SKB_CB(skb)->seq; if (after(TCP_SKB_CB(skb)->end_seq, end)) -- > > Michal Kubecek > > > . >