mbox series

[4.19,stable,0/3] net: ip6 defrag: backport fixes

Message ID 20190409001005.255869-1-posk@google.com
Headers show
Series net: ip6 defrag: backport fixes | expand

Message

Peter Oskolkov April 9, 2019, 12:10 a.m. UTC
Currently, 4.19 and earlier stable kernels contain a security fix
that is not fully IPv6 standard compliant.

This patchset backports IPv6 defrag fixes from 5.1rc that restore
standard-compliance.

Original 5.1 patchet: https://patchwork.ozlabs.org/cover/1029418/


John Masinter (captwiggum), could you, please, confirm that this
patchset fixes TAHI tests?


Peter Oskolkov (3):
  net: IP defrag: encapsulate rbtree defrag code into callable functions
  net: IP6 defrag: use rbtrees for IPv6 defrag
  net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c

 include/net/inet_frag.h                 |  16 +-
 include/net/ipv6_frag.h                 |  11 +-
 net/ipv4/inet_fragment.c                | 293 ++++++++++++++++++++++++
 net/ipv4/ip_fragment.c                  | 290 +++--------------------
 net/ipv6/netfilter/nf_conntrack_reasm.c | 260 ++++++---------------
 net/ipv6/reassembly.c                   | 233 +++++--------------
 6 files changed, 477 insertions(+), 626 deletions(-)

Comments

Captain Wiggum April 14, 2019, 6:28 p.m. UTC | #1
Hi All,

I apologize for the delay, my lab was reserved for some other uses.
But we am going to run the full TAHI IPv6 test suite against this patch
on Tue, and I will reply with the results.

Thanks Peter and Google team for the patch!

--John Masinter

On Mon, Apr 8, 2019 at 6:10 PM Peter Oskolkov <posk@google.com> wrote:
>
> Currently, 4.19 and earlier stable kernels contain a security fix
> that is not fully IPv6 standard compliant.
>
> This patchset backports IPv6 defrag fixes from 5.1rc that restore
> standard-compliance.
>
> Original 5.1 patchet: https://patchwork.ozlabs.org/cover/1029418/
>
>
> John Masinter (captwiggum), could you, please, confirm that this
> patchset fixes TAHI tests?
>
>
> Peter Oskolkov (3):
>   net: IP defrag: encapsulate rbtree defrag code into callable functions
>   net: IP6 defrag: use rbtrees for IPv6 defrag
>   net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c
>
>  include/net/inet_frag.h                 |  16 +-
>  include/net/ipv6_frag.h                 |  11 +-
>  net/ipv4/inet_fragment.c                | 293 ++++++++++++++++++++++++
>  net/ipv4/ip_fragment.c                  | 290 +++--------------------
>  net/ipv6/netfilter/nf_conntrack_reasm.c | 260 ++++++---------------
>  net/ipv6/reassembly.c                   | 233 +++++--------------
>  6 files changed, 477 insertions(+), 626 deletions(-)
>
> --
> 2.21.0.392.gf8f6787159e-goog
>
Captain Wiggum April 17, 2019, 5:51 p.m. UTC | #2
Hi All,

We have built 4.19 with Peter's patch, and now all TAHI IPv6 tests
pass, even another issue I reported is fixed!
This patch looks great from our testing. Please accept this patch...
So that Peter can move on to 4.14.
Thank you Peter and Google crew for this patch!
I look forward to the fix for 4.14, and then 4.9.

--John Masinter

On Sun, Apr 14, 2019 at 12:28 PM Captain Wiggum <captwiggum@gmail.com> wrote:
>
> Hi All,
>
> I apologize for the delay, my lab was reserved for some other uses.
> But we am going to run the full TAHI IPv6 test suite against this patch
> on Tue, and I will reply with the results.
>
> Thanks Peter and Google team for the patch!
>
> --John Masinter
>
> On Mon, Apr 8, 2019 at 6:10 PM Peter Oskolkov <posk@google.com> wrote:
> >
> > Currently, 4.19 and earlier stable kernels contain a security fix
> > that is not fully IPv6 standard compliant.
> >
> > This patchset backports IPv6 defrag fixes from 5.1rc that restore
> > standard-compliance.
> >
> > Original 5.1 patchet: https://patchwork.ozlabs.org/cover/1029418/
> >
> >
> > John Masinter (captwiggum), could you, please, confirm that this
> > patchset fixes TAHI tests?
> >
> >
> > Peter Oskolkov (3):
> >   net: IP defrag: encapsulate rbtree defrag code into callable functions
> >   net: IP6 defrag: use rbtrees for IPv6 defrag
> >   net: IP6 defrag: use rbtrees in nf_conntrack_reasm.c
> >
> >  include/net/inet_frag.h                 |  16 +-
> >  include/net/ipv6_frag.h                 |  11 +-
> >  net/ipv4/inet_fragment.c                | 293 ++++++++++++++++++++++++
> >  net/ipv4/ip_fragment.c                  | 290 +++--------------------
> >  net/ipv6/netfilter/nf_conntrack_reasm.c | 260 ++++++---------------
> >  net/ipv6/reassembly.c                   | 233 +++++--------------
> >  6 files changed, 477 insertions(+), 626 deletions(-)
> >
> > --
> > 2.21.0.392.gf8f6787159e-goog
> >
Sasha Levin April 17, 2019, 8:53 p.m. UTC | #3
On Wed, Apr 17, 2019 at 11:51:27AM -0600, Captain Wiggum wrote:
>Hi All,
>
>We have built 4.19 with Peter's patch, and now all TAHI IPv6 tests
>pass, even another issue I reported is fixed!
>This patch looks great from our testing. Please accept this patch...
>So that Peter can move on to 4.14.
>Thank you Peter and Google crew for this patch!
>I look forward to the fix for 4.14, and then 4.9.

This will need to go through David Miller (or at least acked by him) for
4.19.

--
Thanks,
Sasha
David Miller April 19, 2019, 6:55 p.m. UTC | #4
From: Sasha Levin <sashal@kernel.org>
Date: Wed, 17 Apr 2019 16:53:17 -0400

> On Wed, Apr 17, 2019 at 11:51:27AM -0600, Captain Wiggum wrote:
>>Hi All,
>>
>>We have built 4.19 with Peter's patch, and now all TAHI IPv6 tests
>>pass, even another issue I reported is fixed!
>>This patch looks great from our testing. Please accept this patch...
>>So that Peter can move on to 4.14.
>>Thank you Peter and Google crew for this patch!
>>I look forward to the fix for 4.14, and then 4.9.
> 
> This will need to go through David Miller (or at least acked by him)
> for
> 4.19.

It is a set of reasonably non-trivial changes, however since it fixes
fundamental issues and has had testing, I'm ok with this going into v4.19:

Acked-by: David S. Miller <davem@davemloft.net>
Sasha Levin April 22, 2019, 12:42 a.m. UTC | #5
On Fri, Apr 19, 2019 at 11:55:11AM -0700, David Miller wrote:
>From: Sasha Levin <sashal@kernel.org>
>Date: Wed, 17 Apr 2019 16:53:17 -0400
>
>> On Wed, Apr 17, 2019 at 11:51:27AM -0600, Captain Wiggum wrote:
>>>Hi All,
>>>
>>>We have built 4.19 with Peter's patch, and now all TAHI IPv6 tests
>>>pass, even another issue I reported is fixed!
>>>This patch looks great from our testing. Please accept this patch...
>>>So that Peter can move on to 4.14.
>>>Thank you Peter and Google crew for this patch!
>>>I look forward to the fix for 4.14, and then 4.9.
>>
>> This will need to go through David Miller (or at least acked by him)
>> for
>> 4.19.
>
>It is a set of reasonably non-trivial changes, however since it fixes
>fundamental issues and has had testing, I'm ok with this going into v4.19:
>
>Acked-by: David S. Miller <davem@davemloft.net>

I've queued it up for 4.19, thanks all!


--
Thanks,
Sasha