netdev - Re: [RFC] net: usbnet: prevent buggy devices from killing us

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87y5fig32r.fsf@nemi.mork.no>
Date:	Thu, 24 Jan 2013 13:47:40 +0100
From:	Bjørn Mork <bjorn@...k.no>
To:	Oliver Neukum <oneukum@...e.de>
Cc:	linux-usb@...r.kernel.org, netdev@...r.kernel.org
Subject: Re: [RFC] net: usbnet: prevent buggy devices from killing us

Oliver Neukum <oneukum@...e.de> writes:
> On Thursday 24 January 2013 12:22:54 Bjørn Mork wrote:
>
>> Sorry for being daft, but how do I code the "20 among the last 30" part
>> there?
>
> Just by agreeing that you can live with false negatives but not false positives
>
> if (++counter > 30) {
> 	counter = bogus = 0;
> } else {
> 	if (is_bogus(packet)
> 		bogus++;
> 	if (bogus > counter/2)
> 		throttle();
> }

So, add two new counters to struct usbnet for this?  That seems a little
overkill to me, but I don't see how else to implement anything like that.

It is still not completely clear to me how the throttling/unthrottling
should be done.  It tested with static counters (to avoid having to
rebuild everything for this test) and a new EVENT_RX_THROTTLE flag.
Still on top of my previous patch just for safety while testing, as I am
fed up of having to reboot all the time :-)

Doing the flag test in rx_submit seems simpler than trying to track all
the places this is called.  Still checking the dev->done.qlen to be able
to unthrottle.

Was this along the lines you thought?




diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 85c7ffd..e3a1d63 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -380,6 +382,13 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
 	unsigned long		lockflags;
 	size_t			size = dev->rx_urb_size;
 
+
+	if (test_bit(EVENT_RX_THROTTLE, &dev->flags) && dev->done.qlen > 0) {
+		netif_dbg(dev, rx_err, dev->net, "%s: EVENT_RX_THROTTLE: (done.qlen=%u)\n", __func__, dev->done.qlen);
+		usb_free_urb(urb);
+		return -ENOLINK;
+	}
+
 	/* Do not let a device flood us to death! */
 	if (dev->done.qlen > 1024) {
 		netif_dbg(dev, rx_err, dev->net, "done queue filling up (%u) - throttling\n", dev->done.qlen);
@@ -482,6 +491,7 @@ static void rx_complete (struct urb *urb)
 	struct usbnet		*dev = entry->dev;
 	int			urb_status = urb->status;
 	enum skb_state		state;
+	static int counter, bogus;
 
 	skb_put (skb, urb->actual_length);
 	state = rx_done;
@@ -547,6 +557,17 @@ block:
 		break;
 	}
 
+	/* keep track of bogus packet ratio */
+	if (++counter > 30) {
+		counter = bogus = 0;
+		clear_bit(EVENT_RX_THROTTLE, &dev->flags);
+	} else {
+		if (state == rx_cleanup)
+			bogus++;
+		if (bogus > counter/2)
+			set_bit(EVENT_RX_THROTTLE, &dev->flags);
+	}
+
 	state = defer_bh(dev, skb, &dev->rxq, state);
 
 	if (urb) {


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html