Patch "tcp: do not drop syn_recv on all icmp reports" has been added to the 4.4-stable tree

PATCH [email protected] 1 participant 1 message Feb 29, 2016

Subsystems (3)

Networking Stable branch TCP

lore

Share & tools

lore

[email protected]

author maintainer Applied

2016-02-29 22:45 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

tcp: do not drop syn_recv on all icmp reports

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
tcp-do-not-drop-syn_recv-on-all-icmp-reports.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Mon Feb 29 14:33:50 PST 2016

From: Eric Dumazet <[email protected]>
Date: Tue, 2 Feb 2016 19:31:12 -0800
Subject: tcp: do not drop syn_recv on all icmp reports

From: Eric Dumazet <[email protected]>

[ Upstream commit 9cf7490360bf2c46a16b7525f899e4970c5fc144 ]

Petr Novopashenniy reported that ICMP redirects on SYN_RECV sockets were leading to RST.

This is of course incorrect.

A specific list of ICMP messages should be able to drop a SYN_RECV.

For instance, a REDIRECT on SYN_RECV shall be ignored, as we do not hold a dst per SYN_RECV pseudo request.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111751

Fixes 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")

Reported-by Petr Novopashenniy <[email protected]>

Signed-off-by Eric Dumazet <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/net/tcp.h   |    2 +-
 net/ipv4/tcp_ipv4.c |   11 ++++++++---
 net/ipv6/tcp_ipv6.c |    5 +++--
 3 files changed, 12 insertions(+), 6 deletions(-)

include/net/tcp.h +1 -1

@@ -449,7 +449,7 @@ const u8 *tcp_parse_md5sig_option(const
 
 void tcp_v4_send_check(struct sock *sk, struct sk_buff *skb);
 void tcp_v4_mtu_reduced(struct sock *sk);
-void tcp_req_err(struct sock *sk, u32 seq);
+void tcp_req_err(struct sock *sk, u32 seq, bool abort);
 int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb);
 struct sock *tcp_create_openreq_child(const struct sock *sk,
 				      struct request_sock *req,

net/ipv4/tcp_ipv4.c +8 -3

@@ -312,7 +312,7 @@ static void do_redirect(struct sk_buff *
 
 
 /* handle ICMP messages on TCP_NEW_SYN_RECV request sockets */
-void tcp_req_err(struct sock *sk, u32 seq)
+void tcp_req_err(struct sock *sk, u32 seq, bool abort)
 {
 	struct request_sock *req = inet_reqsk(sk);
 	struct net *net = sock_net(sk);

@@ -324,7 +324,7 @@ void tcp_req_err(struct sock *sk, u32 se
 
 	if (seq != tcp_rsk(req)->snt_isn) {
 		NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
-	} else {
+	} else if (abort) {
 		/*
 		 * Still in SYN_RECV, just remove it silently.
 		 * There is no good way to pass the error to the newly

@@ -384,7 +384,12 @@ void tcp_v4_err(struct sk_buff *icmp_skb
 	}
 	seq = ntohl(th->seq);
 	if (sk->sk_state == TCP_NEW_SYN_RECV)
-		return tcp_req_err(sk, seq);
+		return tcp_req_err(sk, seq,
+				  type == ICMP_PARAMETERPROB ||
+				  type == ICMP_TIME_EXCEEDED ||
+				  (type == ICMP_DEST_UNREACH &&
+				   (code == ICMP_NET_UNREACH ||
+				    code == ICMP_HOST_UNREACH)));
 
 	bh_lock_sock(sk);
 	/* If too many ICMPs get dropped on busy

net/ipv6/tcp_ipv6.c +3 -2

@@ -328,6 +328,7 @@ static void tcp_v6_err(struct sk_buff *s
 	struct tcp_sock *tp;
 	__u32 seq, snd_una;
 	struct sock *sk;
+	bool fatal;
 	int err;
 
 	sk = __inet6_lookup_established(net, &tcp_hashinfo,

@@ -346,8 +347,9 @@ static void tcp_v6_err(struct sk_buff *s
 		return;
 	}
 	seq = ntohl(th->seq);
+	fatal = icmpv6_err_convert(type, code, &err);
 	if (sk->sk_state == TCP_NEW_SYN_RECV)
-		return tcp_req_err(sk, seq);
+		return tcp_req_err(sk, seq, fatal);
 
 	bh_lock_sock(sk);
 	if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)

@@ -401,7 +403,6 @@ static void tcp_v6_err(struct sk_buff *s
 		goto out;
 	}
 
-	icmpv6_err_convert(type, code, &err);
 
 	/* Might be for an request_sock */
 	switch (sk->sk_state) {

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/ipv4-fix-memory-leaks-in-ip_cmsg_send-callers.patch queue-4.4/tcp-dccp-fix-another-race-at-listener-dismantle.patch queue-4.4/ipv6-fix-a-lockdep-splat.patch queue-4.4/ipv6-addrconf-fix-recursive-spin-lock-call.patch queue-4.4/tcp-do-not-drop-syn_recv-on-all-icmp-reports.patch queue-4.4/tcp-beware-of-alignments-in-tcp_get_info.patch queue-4.4/tcp-md5-release-request-socket-instead-of-listener.patch queue-4.4/gro-make-gro-aware-of-lightweight-tunnels.patch queue-4.4/tcp-fix-null-deref-in-tcp_v4_send_ack.patch queue-4.4/af_unix-fix-struct-pid-memory-leak.patch queue-4.4/net-add-sysctl_max_skb_frags.patch