netdev - Re: [PATCH 4.9-stable] tcp: add tcp_ooo_try

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 10 Aug 2018 10:02:32 +0800
From:   maowenan <maowenan@...wei.com>
To:     David Woodhouse <dwmw2@...radead.org>,
        Greg KH <gregkh@...ux-foundation.org>
CC:     <davem@...emloft.net>, <edumazet@...gle.com>,
        <juha-matti.tilli@....fi>, <ycheng@...gle.com>,
        <soheil@...gle.com>, <netdev@...r.kernel.org>,
        <eric.dumazet@...il.com>, <jdw@...zon.de>
Subject: Re: [PATCH 4.9-stable] tcp: add tcp_ooo_try_coalesce() helper



On 2018/8/9 20:52, David Woodhouse wrote:
> On Thu, 2018-08-09 at 14:47 +0200, Greg KH wrote:
>> On Thu, Aug 09, 2018 at 08:37:13PM +0800, maowenan wrote:
>>> There are two patches in stable branch linux-4.4, but I have tested with below patches, and found that the cpu usage was very high.
>>> dc6ae4d tcp: detect malicious patterns in tcp_collapse_ofo_queue()
>>> 5fbec48 tcp: avoid collapses in tcp_prune_queue() if possible
>>>  
>>> test results:
>>> with fix patch： 78.2%   ksoftirqd
>>> no fix patch：   90%     ksoftirqd
>>>  
>>> there is %0 when no attack packets.
>>>  
>>> so please help verify that fixed patches are enough in linux-stable 4.4.
>>>  
>>
>> I do not know, I am not a network developer.  Please try to reproduce
>> the same thing on a newer kernel release and see if the result is the
>> same or not.  If you can find a change that I missed, please let me know
>> and I will be glad to apply it.
> 
> maowenan, there were five patches in the original upstream set to
> address SegmentSmack:
> 
>       tcp: free batches of packets in tcp_prune_ofo_queue()
>       tcp: avoid collapses in tcp_prune_queue() if possible
>       tcp: detect malicious patterns in tcp_collapse_ofo_queue()
>       t
> cp: call tcp_drop() from tcp_data_queue_ofo()
>       tcp: add
> tcp_ooo_try_coalesce() helper
> 
> I believe that the first one, "free batches of packets..." is not
> needed in 4.4 because we only have a simple queue of packets there
> anyway, so we're dropping everything each time and don't need the
> heuristics for how many to drop.
> 
> That leaves two more which have so far not been backported to 4.4; can
> you try applying them and see if it resolves the problem for you?
ok, i will try.
> 
> Thanks.
>