lkml.org 
[lkml]   [2022]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    SubjectRe: [PATCH 1/2] neigh: fix possible DoS due to net iface start/stop loop
    From
    On 7/29/22 4:35 AM, Alexander Mikhalitsyn wrote:
    > The patch proposed doing very simple thing. It drops only packets from

    it does 2 things - adds a namespace check and a performance based change
    with the way the list is walked.

    > the same namespace in the pneigh_queue_purge() where network interface
    > state change is detected. This is enough to prevent the problem for the
    > whole node preserving original semantics of the code.
    >


    > diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    > index 54625287ee5b..213ec0be800b 100644
    > --- a/net/core/neighbour.c
    > +++ b/net/core/neighbour.c

    > @@ -386,8 +396,7 @@ static int __neigh_ifdown(struct neigh_table *tbl, struct net_device *dev,
    > neigh_flush_dev(tbl, dev, skip_perm);
    > pneigh_ifdown_and_unlock(tbl, dev);
    >
    > - del_timer_sync(&tbl->proxy_timer);

    why are you removing this line too?

    > - pneigh_queue_purge(&tbl->proxy_queue);
    > + pneigh_queue_purge(&tbl->proxy_queue, dev_net(dev));
    > return 0;
    > }
    >

    \
     
     \ /
      Last update: 2022-08-01 17:09    [W:4.060 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site