tree 94ac37422a25d79100590494e149b9b7c79c704b
parent 7cb13b5806a2310b24d4b7dca0dea3822c222f84
author Eric Dumazet <edumazet@google.com> 1532687226 +0200
committer Karsten Tausche <karsten@fairphone.com> 1563547014 +0000

UPSTREAM: tcp: avoid collapses in tcp_prune_queue() if possible

[ Upstream commit f4a3313d8e2ca9fd8d8f45e40a2903ba782607e7 ]

Right after a TCP flow is created, receiving tiny out of order
packets allways hit the condition :

if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
	tcp_clamp_window(sk);

tcp_clamp_window() increases sk_rcvbuf to match sk_rmem_alloc
(guarded by tcp_rmem[2])

Calling tcp_collapse_ofo_queue() in this case is not useful,
and offers a O(N^2) surface attack to malicious peers.

Better not attempt anything before full queue capacity is reached,
forcing attacker to spend lots of resource and allow us to more
easily detect the abuse.

Issue: SEC-1404
Change-Id: Ib4fabbd6f22b51fd6eea66a0f3b210543d3ebe01
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Signed-off-by: Chenbo Feng <fengc@google.com>
(cherry picked from commit d7141fe835dd38ffbade34db16868400ff73adde)