Skip to content
Snippets Groups Projects
Commit 9e7ad659 authored by Hannes Frederic Sowa's avatar Hannes Frederic Sowa Committed by Thierry Strudel
Browse files

UPSTREAM: ipv4: try to cache dst_entries which would cause a redirect


(cherry pick from commit df4d9254)

Not caching dst_entries which cause redirects could be exploited by hosts
on the same subnet, causing a severe DoS attack. This effect aggravated
since commit f8864972 ("ipv4: fix dst race in sk_dst_get()").

Lookups causing redirects will be allocated with DST_NOCACHE set which
will force dst_release to free them via RCU.  Unfortunately waiting for
RCU grace period just takes too long, we can end up with >1M dst_entries
waiting to be released and the system will run OOM. rcuos threads cannot
catch up under high softirq load.

Attaching the flag to emit a redirect later on to the specific skb allows
us to cache those dst_entries thus reducing the pressure on allocation
and deallocation.

This issue was discovered by Marcelo Leitner.

Cc: Julian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarMarcelo Leitner <mleitner@redhat.com>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Change-Id: I2928da29b79a94b60023a1c19e464eece0f1dc7a
Bug: 29506807
(cherry picked from commit af1c2a8d2f56b065bff6cf8a51b51d0e8222cdb7)
parent 66aa3e29
No related branches found
No related tags found
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment