• Zhu Yi's avatar
    net: add limit for socket backlog · 8eae939f
    Zhu Yi authored
    We got system OOM while running some UDP netperf testing on the loopback
    device. The case is multiple senders sent stream UDP packets to a single
    receiver via loopback on local host. Of course, the receiver is not able
    to handle all the packets in time. But we surprisingly found that these
    packets were not discarded due to the receiver's sk->sk_rcvbuf limit.
    Instead, they are kept queuing to sk->sk_backlog and finally ate up all
    the memory. We believe this is a secure hole that a none privileged user
    can crash the system.
    
    The root cause for this problem is, when the receiver is doing
    __release_sock() (i.e. after userspace recv, kernel udp_recvmsg ->
    skb_free_datagram_locked -> release_sock), it moves skbs from backlog to
    sk_receive_queue with the softirq enabled. In the above case, multiple
    busy senders will almost make it an endless loop. The skbs in the
    backlog end up eat all the system memory.
    
    The issue is not only for UDP. Any protocols using socket backlog is
    potentially affected. The patch adds limit for socket backlog so that
    the backlog size cannot be expanded endlessly.
    Reported-by: default avatarAlex Shi <alex.shi@intel.com>
    Cc: David Miller <davem@davemloft.net>
    Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
    Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru
    Cc: "Pekka Savola (ipv6)" <pekkas@netcore.fi>
    Cc: Patrick McHardy <kaber@trash.net>
    Cc: Vlad Yasevich <vladislav.yasevich@hp.com>
    Cc: Sridhar Samudrala <sri@us.ibm.com>
    Cc: Jon Maloy <jon.maloy@ericsson.com>
    Cc: Allan Stephens <allan.stephens@windriver.com>
    Cc: Andrew Hendry <andrew.hendry@gmail.com>
    Signed-off-by: default avatarZhu Yi <yi.zhu@intel.com>
    Signed-off-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
    Acked-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    8eae939f
sock.h 47 KB