[PATCH 4.4.y] tcp: Fix missing range_truesize enlargement in the backport

[PATCH 4.4.y] tcp: Fix missing range_truesize enlargement in the backport

[Takashi Iwai]

The 4.4.y stable backport dc6ae4dffd65 for the upstream commit
3d4bf93ac120 ("tcp: detect malicious patterns in
tcp_collapse_ofo_queue()") missed a line that enlarges the
range_truesize value, which broke the whole check.

Fixes: dc6ae4dffd65 ("tcp: detect malicious patterns in tcp_collapse_ofo_queue()")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---

Greg, this is a fix-up specific to 4.4.y stable backport that had a
slightly different form from upstream fix.  I haven't looked at the
older trees, but 4.9.y and later took the upstream fix as is, so this
patch isn't needed for them.

The patch hasn't been tested with the real test case, though; let me
know if the current code is intended.  Thanks!


 net/ipv4/tcp_input.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 4a261e078082..9c4c6cd0316e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4835,6 +4835,7 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
 			end = TCP_SKB_CB(skb)->end_seq;
 			range_truesize = skb->truesize;
 		} else {
+			range_truesize += skb->truesize;
 			if (before(TCP_SKB_CB(skb)->seq, start))
 				start = TCP_SKB_CB(skb)->seq;
 			if (after(TCP_SKB_CB(skb)->end_seq, end))
-- 
2.18.0

Re: [PATCH 4.4.y] tcp: Fix missing range_truesize enlargement in the backport

[Greg Kroah-Hartman]

On Wed, Aug 15, 2018 at 11:58:46AM +0200, Takashi Iwai wrote:
> The 4.4.y stable backport dc6ae4dffd65 for the upstream commit
> 3d4bf93ac120 ("tcp: detect malicious patterns in
> tcp_collapse_ofo_queue()") missed a line that enlarges the
> range_truesize value, which broke the whole check.
> 
> Fixes: dc6ae4dffd65 ("tcp: detect malicious patterns in tcp_collapse_ofo_queue()")
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
> ---
> 
> Greg, this is a fix-up specific to 4.4.y stable backport that had a
> slightly different form from upstream fix.  I haven't looked at the
> older trees, but 4.9.y and later took the upstream fix as is, so this
> patch isn't needed for them.
> 
> The patch hasn't been tested with the real test case, though; let me
> know if the current code is intended.  Thanks!

Hm, I did the initial backport, and then Eric showed what I got wrong
and fixed that up, so being still wrong is not inconceivable at all :)

Have you tried testing this with the reproducer?  That might be the best
verification here.  If your testing proves to be good, I'll gladly take
this patch, thanks!

greg k-h

thanks,

greg k-h

Re: [PATCH 4.4.y] tcp: Fix missing range_truesize enlargement in the backport

[Takashi Iwai]

On Wed, 15 Aug 2018 13:11:21 +0200,
Greg Kroah-Hartman wrote:
> 
> On Wed, Aug 15, 2018 at 11:58:46AM +0200, Takashi Iwai wrote:
> > The 4.4.y stable backport dc6ae4dffd65 for the upstream commit
> > 3d4bf93ac120 ("tcp: detect malicious patterns in
> > tcp_collapse_ofo_queue()") missed a line that enlarges the
> > range_truesize value, which broke the whole check.
> > 
> > Fixes: dc6ae4dffd65 ("tcp: detect malicious patterns in tcp_collapse_ofo_queue()")
> > Signed-off-by: Takashi Iwai <tiwai@suse.de>
> > ---
> > 
> > Greg, this is a fix-up specific to 4.4.y stable backport that had a
> > slightly different form from upstream fix.  I haven't looked at the
> > older trees, but 4.9.y and later took the upstream fix as is, so this
> > patch isn't needed for them.
> > 
> > The patch hasn't been tested with the real test case, though; let me
> > know if the current code is intended.  Thanks!
> 
> Hm, I did the initial backport, and then Eric showed what I got wrong
> and fixed that up, so being still wrong is not inconceivable at all :)
> 
> Have you tried testing this with the reproducer?  That might be the best
> verification here.  If your testing proves to be good, I'll gladly take
> this patch, thanks!

No, I haven't tested it, just followed from the thread in the past
(and hope that our QA team will test that sooner or later :)
Will let you know if we find any issues in the current tree.

And, if the current code works as intended, it's great, of course.


thanks,

Takashi

Re: [PATCH 4.4.y] tcp: Fix missing range_truesize enlargement in the backport

[Michal Kubecek]

On Wed, Aug 15, 2018 at 01:11:21PM +0200, Greg Kroah-Hartman wrote:
> On Wed, Aug 15, 2018 at 11:58:46AM +0200, Takashi Iwai wrote:
> > The 4.4.y stable backport dc6ae4dffd65 for the upstream commit
> > 3d4bf93ac120 ("tcp: detect malicious patterns in
> > tcp_collapse_ofo_queue()") missed a line that enlarges the
> > range_truesize value, which broke the whole check.
> > 
> > Fixes: dc6ae4dffd65 ("tcp: detect malicious patterns in tcp_collapse_ofo_queue()")
> > Signed-off-by: Takashi Iwai <tiwai@suse.de>
> > ---
> > 
> > Greg, this is a fix-up specific to 4.4.y stable backport that had a
> > slightly different form from upstream fix.  I haven't looked at the
> > older trees, but 4.9.y and later took the upstream fix as is, so this
> > patch isn't needed for them.
> > 
> > The patch hasn't been tested with the real test case, though; let me
> > know if the current code is intended.  Thanks!
> 
> Hm, I did the initial backport, and then Eric showed what I got wrong
> and fixed that up, so being still wrong is not inconceivable at all :)

Takashi's follow-up patch is what makes the backport work the same way
as the original mainline commit 3d4bf93ac120. Without it, range_truesize
will be always equal to truesize of first packet in a contiguous range
so that the condition

  range_truesize != head->truesize

will be always false (and there would be no point having range_truesize
variable at all).

Michal Kubecek

Re: [PATCH 4.4.y] tcp: Fix missing range_truesize enlargement in the backport

[Greg Kroah-Hartman]

On Wed, Aug 15, 2018 at 10:02:30PM +0200, Michal Kubecek wrote:
> On Wed, Aug 15, 2018 at 01:11:21PM +0200, Greg Kroah-Hartman wrote:
> > On Wed, Aug 15, 2018 at 11:58:46AM +0200, Takashi Iwai wrote:
> > > The 4.4.y stable backport dc6ae4dffd65 for the upstream commit
> > > 3d4bf93ac120 ("tcp: detect malicious patterns in
> > > tcp_collapse_ofo_queue()") missed a line that enlarges the
> > > range_truesize value, which broke the whole check.
> > > 
> > > Fixes: dc6ae4dffd65 ("tcp: detect malicious patterns in tcp_collapse_ofo_queue()")
> > > Signed-off-by: Takashi Iwai <tiwai@suse.de>
> > > ---
> > > 
> > > Greg, this is a fix-up specific to 4.4.y stable backport that had a
> > > slightly different form from upstream fix.  I haven't looked at the
> > > older trees, but 4.9.y and later took the upstream fix as is, so this
> > > patch isn't needed for them.
> > > 
> > > The patch hasn't been tested with the real test case, though; let me
> > > know if the current code is intended.  Thanks!
> > 
> > Hm, I did the initial backport, and then Eric showed what I got wrong
> > and fixed that up, so being still wrong is not inconceivable at all :)
> 
> Takashi's follow-up patch is what makes the backport work the same way
> as the original mainline commit 3d4bf93ac120. Without it, range_truesize
> will be always equal to truesize of first packet in a contiguous range
> so that the condition
> 
>   range_truesize != head->truesize
> 
> will be always false (and there would be no point having range_truesize
> variable at all).

Thanks, I've now queued this up.

greg k-h