tree e973bee1df2cf4db9b43d475322ca2ee95c2ac16
parent 4f1f0cf0e07eb926ea56a5631ad09ceec437673a
author Eric Dumazet <edumazet@google.com> 1532363299 -0700
committer ChromeOS Commit Bot <chromeos-commit-bot@chromium.org> 1532735381 +0000

BACKPORT: tcp: detect malicious patterns in tcp_collapse_ofo_queue()

[ Upstream commit 3d4bf93ac12003f9b8e1e2de37fe27983deebdcf ]

In case an attacker feeds tiny packets completely out of order,
tcp_collapse_ofo_queue() might scan the whole rb-tree, performing
expensive copies, but not changing socket memory usage at all.

1) Do not attempt to collapse tiny skbs.
2) Add logic to exit early when too many tiny skbs are detected.

We prefer not doing aggressive collapsing (which copies packets)
for pathological flows, and revert to tcp_prune_ofo_queue() which
will be less expensive.

In the future, we might add the possibility of terminating flows
that are proven to be malicious.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c3ccdbc625b7e468f38f35ce98350a1c4b87ab7b
 git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y)

BUG=chromium:866800
TEST=tcp connect

Change-Id: I617048bc9237f090d681f7e8c1a370062b291dd3
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/1153406
Tested-by: Daniel Wang <wonderfly@google.com>
Trybot-Ready: Daniel Wang <wonderfly@google.com>
Commit-Queue: Daniel Wang <wonderfly@google.com>