From 8dc16bd120f2ab353898b3ec4443a5342228530f Mon Sep 17 00:00:00 2001 From: Xin Long Date: Fri, 19 Apr 2019 22:13:28 +0800 Subject: [PATCH] sctp: implement memory accounting on tx path mainline inclusion from mainline-5.1 commit 1033990ac5b2ab6cee93734cb6d301aa3a35bcaa category: bugfix bugzilla: 13690 CVE: CVE-2019-3874 ------------------------------------------------- Now when sending packets, sk_mem_charge() and sk_mem_uncharge() have been used to set sk_forward_alloc. We just need to call sk_wmem_schedule() to check if the allocated should be raised, and call sk_mem_reclaim() to check if the allocated should be reduced when it's under memory pressure. If sk_wmem_schedule() returns false, which means no memory is allowed to allocate, it will block and wait for memory to become available. Note different from tcp, sctp wait_for_buf happens before allocating any skb, so memory accounting check is done with the whole msg_len before it too. Reported-by: Matteo Croce Tested-by: Matteo Croce Acked-by: Neil Horman Acked-by: Marcelo Ricardo Leitner Signed-off-by: Xin Long Signed-off-by: David S. Miller Conflicts: net/sctp/socket.c [yyl: adjust context] Signed-off-by: Yang Yingliang Reviewed-by: Wei Yongjun Signed-off-by: Yang Yingliang --- net/sctp/socket.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 8c00a7ef1bcd..78e88ddb1e4b 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1931,7 +1931,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc, if (sctp_wspace(asoc) < msg_len) sctp_prsctp_prune(asoc, sinfo, msg_len - sctp_wspace(asoc)); - if (!sctp_wspace(asoc)) { + if (sk_under_memory_pressure(sk)) + sk_mem_reclaim(sk); + + if (!sctp_wspace(asoc) || !sk_wmem_schedule(sk, msg_len)) { timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); if (err) @@ -8532,7 +8535,10 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, goto do_error; if (signal_pending(current)) goto do_interrupted; - if (msg_len <= sctp_wspace(asoc)) + if (sk_under_memory_pressure(sk)) + sk_mem_reclaim(sk); + if (msg_len <= sctp_wspace(asoc) && + sk_wmem_schedule(sk, msg_len)) break; /* Let another process have a go. Since we are going -- GitLab