Linux 4.4.174
Greg KH
maintainerI'm announcing the release of the 4.4.174 kernel.
All users of the 4.4 kernel series must upgrade.
Many thanks to Ben Hutchings for this release, it's pretty much just his work here in doing the backporting of networking fixes to help resolve "FragmentSmack" (i.e. CVE-2018-5391).
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/networking/ip-sysctl.txt | 13 Makefile | 2 include/linux/rhashtable.h | 143 ++++++-- include/linux/skbuff.h | 16 include/net/inet_frag.h | 133 +++---- include/net/ip.h | 1 include/net/ipv6.h | 26 - include/uapi/linux/snmp.h | 1 kernel/rcu/tree.c | 2 lib/rhashtable.c | 15 net/core/skbuff.c | 21 + net/ieee802154/6lowpan/6lowpan_i.h | 26 - net/ieee802154/6lowpan/reassembly.c | 148 ++++---- net/ipv4/inet_fragment.c | 389 ++++----------------- net/ipv4/ip_fragment.c | 571 +++++++++++++++++--------------- net/ipv4/proc.c | 7 net/ipv6/netfilter/nf_conntrack_reasm.c | 100 ++--- net/ipv6/proc.c | 5 net/ipv6/reassembly.c | 209 ++++++----- 19 files changed, 867 insertions(+), 961 deletions(-)
Alexander Aring (1):
net: ieee802154: 6lowpan: fix frag reassembly
Ben Hutchings (1):
rhashtable: Add rhashtable_lookup()
Dan Carpenter (1):
ipv4: frags: precedence bug in ip_expire()
Dimitris Michailidis (1):
net: fix pskb_trim_rcsum_slow() with odd trim offset
Eric Dumazet (19):
inet: frags: change inet_frags_init_net() return value
inet: frags: add a pointer to struct netns_frags
inet: frags: refactor ipfrag_init()
inet: frags: refactor ipv6_frag_init()
inet: frags: refactor lowpan_net_frag_init()
rhashtable: add schedule points
inet: frags: use rhashtables for reassembly units
inet: frags: remove some helpers
inet: frags: get rif of inet_frag_evicting()
inet: frags: remove inet_frag_maybe_warn_overflow()
inet: frags: break the 2GB limit for frags storage
inet: frags: do not clone skb in ip_expire()
ipv6: frags: rewrite ip6_expire_frag_queue()
rhashtable: reorganize struct rhashtable layout
inet: frags: reorganize struct netns_frags
inet: frags: get rid of ipfrag_skb_cb/FRAG_CB
inet: frags: fix ip6frag_low_thresh boundary
net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends
inet: frags: better deal with smp races
Florian Westphal (1):
ipv6: defrag: drop non-last frags smaller than min mtu
Greg Kroah-Hartman (1):
Linux 4.4.174
Michal Kubecek (1):
net: ipv4: do not handle duplicate fragments as overlapping
Pablo Neira Ayuso (1):
rhashtable: add rhashtable_lookup_get_insert_key()
Paolo Abeni (1):
ipfrag: really prevent allocation on netns exit
Paul E. McKenney (1):
rcu: Force boolean subscript for expedited stall warnings
Peter Oskolkov (5):
ip: discard IPv4 datagrams with overlapping segments.
net: modify skb_rbtree_purge to return the truesize of all purged skbs.
ip: use rb trees for IP frag queue.
ip: add helpers to process in-order fragments faster.
ip: process in-order fragments efficiently
Taehee Yoo (1):
ip: frags: fix crash in ip_do_fragment()
Greg KH
maintainerDocumentation/networking/ip-sysctl.txt +5 -8
@@ -112,14 +112,11 @@ min_adv_mss - INTEGER IP Fragmentation: -ipfrag_high_thresh - INTEGER - Maximum memory used to reassemble IP fragments. When - ipfrag_high_thresh bytes of memory is allocated for this purpose, - the fragment handler will toss packets until ipfrag_low_thresh - is reached. This also serves as a maximum limit to namespaces - different from the initial one. - -ipfrag_low_thresh - INTEGER +ipfrag_high_thresh - LONG INTEGER + Maximum memory used to reassemble IP fragments. + +ipfrag_low_thresh - LONG INTEGER + (Obsolete since linux-4.17) Maximum memory used to reassemble IP fragments before the kernel begins to remove incomplete fragment queues to free up resources. The kernel still accepts new fragments for defragmentation.
Makefile +1 -1
@@ -1,6 +1,6 @@ VERSION = 4 PATCHLEVEL = 4 -SUBLEVEL = 173 +SUBLEVEL = 174 EXTRAVERSION = NAME = Blurry Fish Butt
include/linux/rhashtable.h +111 -32
261 lines not on this page · raw message
include/linux/skbuff.h +10 -6
@@ -556,9 +556,14 @@ struct sk_buff {struct skb_mstamp skb_mstamp; }; }; -struct rb_node rbnode;/* used in netem & tcp stack */ +struct rb_node rbnode;/* used in netem, ip4 defrag, and tcp stack */ }; -struct sock *sk; + +union { +struct sock *sk; +int ip_defrag_offset; + }; +struct net_device *dev;/*
@@ -2273,7 +2278,7 @@ static inline void __skb_queue_purge(struct sk_buff_head *list)kfree_skb (skb); } -void skb_rbtree_purge (struct rb_root *root); +unsigned int skb_rbtree_purge (struct rb_root *root);void *netdev_alloc_frag (unsigned int fragsz);
@@ -2791,6 +2796,7 @@ static inline unsigned char *skb_push_rcsum(struct sk_buff *skb,return skb->data; } +int pskb_trim_rcsum_slow (struct sk_buff *skb,unsigned int len);/** * pskb_trim_rcsum - trim received skb and update checksum * @skb: buffer to trim
@@ -2805,9 +2811,7 @@ static inline int pskb_trim_rcsum(struct sk_buff *skb, unsigned int len) {if (likely (len >= skb->len))return 0 ; -if (skb->ip_summed ==CHECKSUM_COMPLETE ) - skb->ip_summed =CHECKSUM_NONE ; -return __pskb_trim (skb, len); +return pskb_trim_rcsum_slow (skb, len); }#define rb_to_skb (rb) rb_entry_safe(rb, struct sk_buff, rbnode)
include/net/inet_frag.h +62 -71
205 lines not on this page · raw message
include/net/ip.h +0 -1
@@ -524,7 +524,6 @@ static inline struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *s return skb; }#endif -int ip_frag_mem (struct net *net);/* * Functions provided by ip_forward.c
include/net/ipv6.h +2 -24
@@ -320,13 +320,6 @@ static inline bool ipv6_accept_ra(struct inet6_dev *idev) idev->cnf.accept_ra; } -#if IS_ENABLED (CONFIG_IPV6 ) -static inline int ip6_frag_mem (struct net *net) -{ -return sum_frag_mem_limit (&net->ipv6.frags); -} -#endif -#define IPV6_FRAG_HIGH_THRESH (4 * 1024*1024)/* 4194304 */ #define IPV6_FRAG_LOW_THRESH (3 * 1024*1024)/* 3145728 */ #define IPV6_FRAG_TIMEOUT (60 * HZ)/* 60 seconds */
@@ -505,17 +498,8 @@ enum ip6_defrag_users { __IP6_DEFRAG_CONNTRACK_BRIDGE_IN = IP6_DEFRAG_CONNTRACK_BRIDGE_IN + USHRT_MAX, }; -struct ip6_create_arg { -__be32 id; -u32 user; -const struct in6_addr *src; -const struct in6_addr *dst; -int iif; -u8 ecn; -}; -void ip6_frag_init (struct inet_frag_queue *q,const void *a); -bool ip6_frag_match (const struct inet_frag_queue *q,const void *a); +extern const struct rhashtable_params ip6_rhash_params;/* * Equivalent of ipv4 struct ip
@@ -523,19 +507,13 @@ bool ip6_frag_match(const struct inet_frag_queue *q, const void *a);struct frag_queue {struct inet_frag_queue q; -__be32 id;/* fragment id */ -u32 user; -struct in6_addr saddr; -struct in6_addr daddr; -int iif;unsigned int csum;__u16 nhoffset;u8 ecn; }; -void ip6_expire_frag_queue (struct net *net,struct frag_queue *fq, -struct inet_frags *frags); +void ip6_expire_frag_queue (struct net *net,struct frag_queue *fq);static inline bool ipv6_addr_any (const struct in6_addr *a) {
include/uapi/linux/snmp.h +1 -0
@@ -55,6 +55,7 @@ enumIPSTATS_MIB_ECT1PKTS ,/* InECT1Pkts */ IPSTATS_MIB_ECT0PKTS ,/* InECT0Pkts */ IPSTATS_MIB_CEPKTS ,/* InCEPkts */ +IPSTATS_MIB_REASM_OVERLAPS ,/* ReasmOverlaps */ __IPSTATS_MIB_MAX };
kernel/rcu/tree.c +1 -1
@@ -3817,7 +3817,7 @@ static void synchronize_sched_expedited_wait(struct rcu_state *rsp)continue ; rdp =per_cpu_ptr (rsp->rda, cpu);pr_cont (" %d-%c%c%c" , cpu, -"O." [cpu_online (cpu)], +"O." [!!cpu_online (cpu)],"o." [!!(rdp->grpmask & rnp->expmaskinit)],"N." [!!(rdp->grpmask & rnp->expmaskinitnext)]); }
lib/rhashtable.c +11 -4
@@ -250,8 +250,10 @@ static int rhashtable_rehash_table(struct rhashtable *ht)if (!new_tbl)return 0 ; -for (old_hash =0 ; old_hash < old_tbl->size; old_hash++) +for (old_hash =0 ; old_hash < old_tbl->size; old_hash++) {rhashtable_rehash_chain (ht, old_hash); +cond_resched (); + }/* Publish the new table pointer. */ rcu_assign_pointer (ht->tbl, new_tbl);
@@ -441,7 +443,8 @@ EXPORT_SYMBOL_GPL(rhashtable_insert_rehash);struct bucket_table *rhashtable_insert_slow (struct rhashtable *ht,const void *key,struct rhash_head *obj, -struct bucket_table *tbl) +struct bucket_table *tbl, +void **data) {struct rhash_head *head;unsigned int hash;
@@ -452,8 +455,11 @@ struct bucket_table *rhashtable_insert_slow(struct rhashtable *ht,spin_lock_nested (rht_bucket_lock (tbl, hash),SINGLE_DEPTH_NESTING ); err = -EEXIST ; -if (key &&rhashtable_lookup_fast (ht, key, ht->p)) - goto exit; +if (key) { + *data =rhashtable_lookup_fast (ht, key, ht->p); +if (*data) + goto exit; + } err = -E2BIG ;if (unlikely (rht_grow_above_max (ht, tbl)))
@@ -838,6 +844,7 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,for (i =0 ; i < tbl->size; i++) {struct rhash_head *pos, *next; +cond_resched (); for (pos = rht_dereference(tbl->buckets[i], ht), next = !rht_is_a_nulls(pos) ? rht_dereference(pos->next, ht) : NULL;
net/core/skbuff.c +20 -1
@@ -1502,6 +1502,21 @@ done: }EXPORT_SYMBOL (___pskb_trim); +/* Note : use pskb_trim_rcsum() instead of calling this directly +*/ +int pskb_trim_rcsum_slow (struct sk_buff *skb,unsigned int len) +{ +if (skb->ip_summed ==CHECKSUM_COMPLETE ) { +int delta = skb->len - len; + + skb->csum =csum_block_sub (skb->csum, +skb_checksum (skb, len, delta,0 ), + len); + } +return __pskb_trim (skb, len); +} +EXPORT_SYMBOL (pskb_trim_rcsum_slow); +/** * __pskb_pull_tail - advance tail of skb header * @skb: buffer to reallocate
@@ -2380,23 +2395,27 @@ EXPORT_SYMBOL(skb_queue_purge);/** * skb_rbtree_purge - empty a skb rbtree * @root: root of the rbtree to empty +* Return value: the sum of truesizes of all purged skbs. * * Delete all buffers on an &sk_buff rbtree. Each buffer is removed from * the list and one reference dropped. This function does not take * any lock. Synchronization should be handled by the caller (e.g., TCP * out-of-order queue is protected by the socket lock). */ -void skb_rbtree_purge (struct rb_root *root) +unsigned int skb_rbtree_purge (struct rb_root *root) {struct rb_node *p =rb_first (root); +unsigned int sum =0 ;while (p) { struct sk_buff *skb = rb_entry(p, struct sk_buff, rbnode); p =rb_next (p);rb_erase (&skb->rbnode, root); + sum += skb->truesize;kfree_skb (skb); } +return sum; }/**
net/ieee802154/6lowpan/6lowpan_i.h +4 -22
@@ -16,37 +16,19 @@ typedef unsigned __bitwise__ lowpan_rx_result;#define LOWPAN_DISPATCH_FRAG1 0xc0#define LOWPAN_DISPATCH_FRAGN 0xe0 -struct lowpan_create_arg { +struct frag_lowpan_compare_key {u16 tag;u16 d_size; -const struct ieee802154_addr *src; -const struct ieee802154_addr *dst; +struct ieee802154_addr src; +struct ieee802154_addr dst; }; -/* Equivalent of ipv4 struct ip +/* Equivalent of ipv4 struct ipq */ struct lowpan_frag_queue {struct inet_frag_queue q; - -u16 tag; -u16 d_size; -struct ieee802154_addr saddr; -struct ieee802154_addr daddr; }; -static inline u32 ieee802154_addr_hash (const struct ieee802154_addr *a) -{ -switch (a->mode) { -case IEEE802154_ADDR_LONG : -return (((__force u64 )a->extended_addr) >>32 ) ^ - (((__force u64 )a->extended_addr) &0xffffffff ); -case IEEE802154_ADDR_SHORT : -return (__force u32)(a->short_addr); -default : -return 0 ; - } -} -/* private device info */ struct lowpan_dev_info {struct net_device *wdev;/* wpan device ptr */
net/ieee802154/6lowpan/reassembly.c +73 -75
254 lines not on this page · raw message
net/ipv4/inet_fragment.c +87 -302
479 lines not on this page · raw message
net/ipv4/ip_fragment.c +321 -250
821 lines not on this page · raw message
net/ipv4/proc.c +4 -3
@@ -52,7 +52,6 @@static int sockstat_seq_show (struct seq_file *seq,void *v) {struct net *net = seq->private; -unsigned int frag_mem;int orphans, sockets;local_bh_disable ();
@@ -72,8 +71,9 @@ static int sockstat_seq_show(struct seq_file *seq, void *v) sock_prot_inuse_get(net, &udplite_prot));seq_printf (seq,"RAW: inuse %d\n" ,sock_prot_inuse_get (net, &raw_prot)); - frag_mem =ip_frag_mem (net); -seq_printf (seq,"FRAG: inuse %u memory %u\n" , !!frag_mem, frag_mem); +seq_printf (seq,"FRAG: inuse %u memory %lu\n" , +atomic_read (&net->ipv4.frags.rhashtable.nelems), +frag_mem_limit (&net->ipv4.frags));return 0 ; }
@@ -132,6 +132,7 @@ static const struct snmp_mib snmp4_ipextstats_list[] = {SNMP_MIB_ITEM ("InECT1Pkts" ,IPSTATS_MIB_ECT1PKTS ),SNMP_MIB_ITEM ("InECT0Pkts" ,IPSTATS_MIB_ECT0PKTS ),SNMP_MIB_ITEM ("InCEPkts" ,IPSTATS_MIB_CEPKTS ), +SNMP_MIB_ITEM ("ReasmOverlaps" ,IPSTATS_MIB_REASM_OVERLAPS ), SNMP_MIB_SENTINEL };
net/ipv6/netfilter/nf_conntrack_reasm.c +43 -57
206 lines not on this page · raw message
net/ipv6/proc.c +3 -2
@@ -33,7 +33,6 @@static int sockstat6_seq_show (struct seq_file *seq,void *v) {struct net *net = seq->private; -unsigned int frag_mem =ip6_frag_mem (net);seq_printf (seq,"TCP6: inuse %d\n" ,sock_prot_inuse_get (net, &tcpv6_prot));
@@ -43,7 +42,9 @@ static int sockstat6_seq_show(struct seq_file *seq, void *v) sock_prot_inuse_get(net, &udplitev6_prot));seq_printf (seq,"RAW6: inuse %d\n" ,sock_prot_inuse_get (net, &rawv6_prot)); -seq_printf (seq,"FRAG6: inuse %u memory %u\n" , !!frag_mem, frag_mem); +seq_printf (seq,"FRAG6: inuse %u memory %lu\n" , +atomic_read (&net->ipv6.frags.rhashtable.nelems), +frag_mem_limit (&net->ipv6.frags));return 0 ; }
net/ipv6/reassembly.c +108 -101
356 lines not on this page · raw message
Quoted 11 lines · Greg KH
Documentation/networking/ip-sysctl.txt +0
-3@@ -112,14 +112,11 @@ min_adv_mss - INTEGER IP Fragmentation: -ipfrag_high_thresh - INTEGER - Maximum memory used to reassemble IP fragments. When - ipfrag_high_thresh bytes of memory is allocated for this purpose,
Documentation/networking/ip-sysctl.txt min_adv_mss - INTEGER · line 119
Quoted 10 lines
Documentation/networking/ip-sysctl.txt +5
-5- the fragment handler will toss packets until ipfrag_low_thresh - is reached. This also serves as a maximum limit to namespaces - different from the initial one. - -ipfrag_low_thresh - INTEGER +ipfrag_high_thresh - LONG INTEGER + Maximum memory used to reassemble IP fragments. + +ipfrag_low_thresh - LONG INTEGER + (Obsolete since linux-4.17)
It seems very strange to say that it is obsolete since 4.17 in a 4.4 kernel.
Documentation/networking/ip-sysctl.txt min_adv_mss - INTEGER · line 122
Quoted 3 lines
Documentation/networking/ip-sysctl.txt +0
-0Maximum memory used to reassemble IP fragments before the kernel begins to remove incomplete fragment queues to free up resources. The kernel still accepts new fragments for defragmentation.
--
Mark Rustad, [email protected]
Greg KH
maintainerQuoted 11 lines · Mark D Rustad
Quoted 9 lines · Greg KH
Documentation/networking/ip-sysctl.txt +0
-0@@ -112,14 +112,11 @@ min_adv_mss - INTEGER IP Fragmentation:
Quoted 15 lines
Documentation/networking/ip-sysctl.txt min_adv_mss - INTEGER · line 119
Quoted 13 lines
Documentation/networking/ip-sysctl.txt +5
-8-ipfrag_high_thresh - INTEGER - Maximum memory used to reassemble IP fragments. When - ipfrag_high_thresh bytes of memory is allocated for this purpose, - the fragment handler will toss packets until ipfrag_low_thresh - is reached. This also serves as a maximum limit to namespaces - different from the initial one. - -ipfrag_low_thresh - INTEGER +ipfrag_high_thresh - LONG INTEGER + Maximum memory used to reassemble IP fragments. + +ipfrag_low_thresh - LONG INTEGER + (Obsolete since linux-4.17)It seems very strange to say that it is obsolete since 4.17 in a 4.4 kernel.
4.17 is a point in time :)
Quoted 28 lines · Greg KH
Quoted 11 lines · Mark D Rustad
Quoted 9 lines · Greg KH
Documentation/networking/ip-sysctl.txt +0
-0@@ -112,14 +112,11 @@ min_adv_mss - INTEGER IP Fragmentation:Quoted 15 lines
Documentation/networking/ip-sysctl.txt min_adv_mss - INTEGER · line 119
Quoted 13 lines
Documentation/networking/ip-sysctl.txt +5
-8-ipfrag_high_thresh - INTEGER - Maximum memory used to reassemble IP fragments. When - ipfrag_high_thresh bytes of memory is allocated for this purpose, - the fragment handler will toss packets until ipfrag_low_thresh - is reached. This also serves as a maximum limit to namespaces - different from the initial one. - -ipfrag_low_thresh - INTEGER +ipfrag_high_thresh - LONG INTEGER + Maximum memory used to reassemble IP fragments. + +ipfrag_low_thresh - LONG INTEGER + (Obsolete since linux-4.17)It seems very strange to say that it is obsolete since 4.17 in a 4.4 kernel.
Quoted 1 line
4.17 is a point in time :)
Of course I understand, but some random non-kernel-developer tuning a kernel may be pretty puzzled. I don't know right off the top something brief that would be more generally meaningful, but maybe someone might. What does obsolete mean in this context? It exists but does nothing? It exists and does something but will eventually go away?
--
Mark Rustad, [email protected]
Greg KH
maintainerQuoted 31 lines · Mark D Rustad
Quoted 29 lines · Greg KH
Quoted 27 lines · Mark D Rustad
Quoted 12 lines · Greg KH
Documentation/networking/ip-sysctl.txt +0
-3@@ -112,14 +112,11 @@ min_adv_mss - INTEGER IP Fragmentation: -ipfrag_high_thresh - INTEGER - Maximum memory used to reassemble IP fragments. When - ipfrag_high_thresh bytes of memory is allocated for this purpose,Documentation/networking/ip-sysctl.txt min_adv_mss - INTEGER · line 119
Quoted 10 lines
Documentation/networking/ip-sysctl.txt +5
-5- the fragment handler will toss packets until ipfrag_low_thresh - is reached. This also serves as a maximum limit to namespaces - different from the initial one. - -ipfrag_low_thresh - INTEGER +ipfrag_high_thresh - LONG INTEGER + Maximum memory used to reassemble IP fragments. + +ipfrag_low_thresh - LONG INTEGER + (Obsolete since linux-4.17)It seems very strange to say that it is obsolete since 4.17 in a 4.4 kernel.
Quoted 7 lines
Quoted 1 line
4.17 is a point in time :)
Of course I understand, but some random non-kernel-developer tuning a kernel may be pretty puzzled. I don't know right off the top something brief that would be more generally meaningful, but maybe someone might. What does obsolete mean in this context? It exists but does nothing? It exists and does something but will eventually go away?
Fair enough, want to provide a patch with the real kernel version this happened in?
thanks,
greg k-h