netdev - [stable regression] tcp: make connect() mem charging friendly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1428996723.3211.34.camel@decadent.org.uk>
Date:	Tue, 14 Apr 2015 08:32:03 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	netdev <netdev@...r.kernel.org>, stable <stable@...r.kernel.org>
Cc:	Eric Dumazet <edumazet@...gle.com>, 782515@...s.debian.org
Subject: [stable regression] tcp: make connect() mem charging friendly

Commit 355a901e6cf1b2b763ec85caa2a9f04fbcc4ab4a ("tcp: make connect()
mem charging friendly") was backported to various stable branches:

v3.10.73: e64a85197b3f tcp: make connect() mem charging friendly
v3.12.40: d06381e8aac5 tcp: make connect() mem charging friendly
v3.14.37: 5a8e8f482b4a tcp: make connect() mem charging friendly
v3.18.11: e8f117f002ca tcp: make connect() mem charging friendly
v3.13.11-ckt19: de023863df9d tcp: make connect() mem charging friendly
v3.16.7-ckt9: bea5f6ef9fcb tcp: make connect() mem charging friendly

On the 3.16 branch, this has resulted in a regression for TCP Fast Open:
<https://bugs.debian.org/782515>.  The BUG() at the top of
tcp_transmit_skb() fires as tcp_skb_pcount(skb) == 0.

tcp_send_syn_data() does:

	memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));

Since commit cd7d8498c9a5 ("tcp: change tcp_skb_pcount() location") this
is sufficient to set the GSO segment count correctly.  But in older
branches (< 3.18) the GSO segment count in skb_shared_info is used and
is no longer copied by tcp_send_syn_data().

All the versions listed above, except v3.18.11, appear to have suffered
this regression.

Ben.

-- 
Ben Hutchings
Editing code like this is akin to sticking plasters on the bleeding stump
of a severed limb. - me, 29 June 1999

Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)