From: Shan Wei <shanwei@cn•fujitsu.com>
To: David Miller <davem@davemloft•net>
Cc: schen@mvista•com, netdev@vger•kernel.org
Subject: Re: possible kernel oops from user MSS
Date: Thu, 11 Nov 2010 13:15:01 +0800 [thread overview]
Message-ID: <4CDB7BD5.6030204@cn.fujitsu.com> (raw)
In-Reply-To: <20101110.124119.102563803.davem@davemloft.net>
David Miller wrote, at 11/11/2010 04:41 AM:
> From: Steve Chen <schen@mvista•com>
> Date: Wed, 10 Nov 2010 07:24:51 -0600
>
>> With commit f5fff5dc8a7a3f395b0525c02ba92c95d42b7390, a user program
>> can pass in TCP_MAXSEG of 12 (or TCPOLEN_TSTAMP_ALIGNED), and cause
>> kernel oops with division by 0
>> in tcp_select_initial_window. One way to prevent it is to change the
>> minimum value for TCP_MAXSEG in do_tcp_setsockopt from 8 to some value
>> over 12. Two questions.
>>
>> 1. Is this the right solution?
>> 2. If it is, what is a good minimum value?
>
> Thanks Steve, I'll fix this like so:
>
> --------------------
> tcp: Increase TCP_MAXSEG socket option minimum.
>
> As noted by Steve Chen, since commit
> f5fff5dc8a7a3f395b0525c02ba92c95d42b7390 ("tcp: advertise MSS
> requested by user") we can end up with a situation where
> tcp_select_initial_window() does a divide by a zero (or
> even negative) mss value.
>
> The problem is that sometimes we subtract TCPOLEN_TSTAMP_ALIGNED
> from the mss.
>
> Fix this by increasing the minimum from 8 to 8 plus the value
> of TCPOLEN_TSTATMP_ALIGNED.
In tcp_connect_init(), if tcp_header_len includes TCPOLEN_TSTAMP_ALIGNED(12 bytes)
and TCPOLEN_MD5SIG_ALIGNED(20 bytes).
This fix is still not perfect.
The minimum value of TCP_MAXSEG is 20 tytes, tcp_select_initial_window() still be
called with negative mss value.
--
Best Regards
-----
Shan Wei
> Reported-by: Steve Chen <schen@mvista•com>
> Signed-off-by: David S. Miller <davem@davemloft•net>
> ---
> net/ipv4/tcp.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index 245603c..6b0eb4d 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
> /* Values greater than interface MTU won't take effect. However
> * at the point when this call is done we typically don't yet
> * know which interface is going to be used */
> - if (val < 8 || val > MAX_TCP_WINDOW) {
> + if (val < TCPOLEN_TSTAMP_ALIGNED + 8 || val > MAX_TCP_WINDOW) {
> err = -EINVAL;
> break;
> }
next prev parent reply other threads:[~2010-11-11 5:15 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-11-10 13:24 possible kernel oops from user MSS Steve Chen
2010-11-10 20:41 ` David Miller
2010-11-11 5:15 ` Shan Wei [this message]
2010-11-11 5:33 ` David Miller
2010-11-11 5:36 ` David Miller
2010-11-11 5:37 ` Shan Wei
[not found] ` <AANLkTin-gXceUQxKvQeP8Nc8oXZDJnyjoFUjYD5x_g_y@mail.gmail.com>
2010-11-12 22:59 ` Min Zhang
2010-11-12 23:26 ` David Miller
2010-11-23 2:48 ` Li Yewang
2010-11-23 2:59 ` David Miller
2010-11-24 19:47 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4CDB7BD5.6030204@cn.fujitsu.com \
--to=shanwei@cn$(echo .)fujitsu.com \
--cc=davem@davemloft$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=schen@mvista$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox