• Eric Dumazet's avatar
    inet: frag: enforce memory limits earlier · 56e2c94f
    Eric Dumazet authored
    We currently check current frags memory usage only when
    a new frag queue is created. This allows attackers to first
    consume the memory budget (default : 4 MB) creating thousands
    of frag queues, then sending tiny skbs to exceed high_thresh
    limit by 2 to 3 order of magnitude.
    
    Note that before commit 648700f7 ("inet: frags: use rhashtables
    for reassembly units"), work queue could be starved under DOS,
    getting no cpu cycles.
    After commit 648700f7, only the per frag queue timer can eventually
    remove an incomplete frag queue and its skbs.
    
    Fixes: b13d3cbf ("inet: frag: move eviction of queues to work queue")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarJann Horn <jannh@google.com>
    Cc: Florian Westphal <fw@strlen.de>
    Cc: Peter Oskolkov <posk@google.com>
    Cc: Paolo Abeni <pabeni@redhat.com>
    Acked-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    56e2c94f
inet_fragment.c 5.44 KB