netdev - Re: [PATCH net] ipv6: un-do: defrag: drop non-last frags smaller than min mtu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 6 Apr 2019 18:34:19 +0200
From:   Florian Westphal <fw@...len.de>
To:     Sasha Levin <sashal@...nel.org>
Cc:     Captain Wiggum <captwiggum@...il.com>, davem@...emloft.net,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Florian Westphal <fw@...len.de>,
        Eric Dumazet <edumazet@...gle.com>,
        Peter Oskolkov <posk@...gle.com>, netdev@...r.kernel.org,
        stable@...r.kernel.org
Subject: Re: [PATCH net] ipv6: un-do: defrag: drop non-last frags smaller
 than min mtu

Sasha Levin <sashal@...nel.org> wrote:
> > > > Two patches from upstream needed first to cover the DoS:
> > > >
> > > > commit d4289fcc9b16b89619ee1c54f829e05e56de8b9a
> > > > net: IP6 defrag: use rbtrees for IPv6 defrag
> > > >
> > > > commit 997dd96471641e147cb2c33ad54284000d0f5e35
> > > > net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c

[..]

> I see that 0ed4229b08c1 ("ipv6: defrag: drop non-last frags smaller than
> min mtu") wasn't reverted upstream, why is a revert needed on the stable
> trees?

As I already mentioned, reverting it brings back the DoS problem.
The "drop < minmtu" restriction is removed in the two rbtree conversion
patches quoted above.