tree 28b0ced18da7f141ebd74094203487f0c05cf798
parent f474031a9e8ce8f18d98443db678e31db0ed74c3
author Eric Dumazet <edumazet@google.com> 1532687227 +0200
committer Karsten Tausche <karsten@fairphone.com> 1563547024 +0000

UPSTREAM: tcp: detect malicious patterns in tcp_collapse_ofo_queue()

[ Upstream commit 3d4bf93ac12003f9b8e1e2de37fe27983deebdcf ]

In case an attacker feeds tiny packets completely out of order,
tcp_collapse_ofo_queue() might scan the whole rb-tree, performing
expensive copies, but not changing socket memory usage at all.

1) Do not attempt to collapse tiny skbs.
2) Add logic to exit early when too many tiny skbs are detected.

We prefer not doing aggressive collapsing (which copies packets)
for pathological flows, and revert to tcp_prune_ofo_queue() which
will be less expensive.

In the future, we might add the possibility of terminating flows
that are proven to be malicious.

Issue: SEC-1404
Change-Id: I635a058ea387b224d1d0ac7653cc4dfc0aadab3a
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Signed-off-by: Chenbo Feng <fengc@google.com>
(cherry picked from commit 9da646e724099a0eb37d0a5d034d3d5ee8131ffe)