tcp: Avoid ABI change for DoS fixes

"tcp: tcp_fragment() should apply sane memory limits" adds a new Linux
MIB counter.  This adds another element to the array in struct
linux_mib.  Since that is always allocated by built-in code, it's a
backward-compatible change and we can hide the added element from
genksyms.

"tcp: add tcp_min_snd_mss sysctl" adds a new per-netns sysctl and a
new members in struct netns_ipv4.  Since this is embedded in struct
net, it changes the offsets of all the following members.  However
struct net itself is not embedded in anything, and is always allocated
by built-in code.  So move the new member to the end of struct net,
and hide it from genksyms.

Also hide the added element and member from modules, as they won't be
able to rely on their being present until we bump ABI.

Gbp-Pq: Topic debian/abi
Gbp-Pq: Name tcp-avoid-abi-change-for-dos-fixes.patch

diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 3f7b166262d72c1d95c7df3bdbaa2c80b5bca78d..5fcf3b82715fbe2f3b1c9dc60a65280192f36f0b 100644 (file)
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -161,6 +161,9 @@ struct net {
 #endif
        struct sock             *diag_nlsk;
        atomic_t                fnhe_genid;
+#if !defined(__GENKSYMS__) && !defined(MODULE)
+       int                     ipv4_sysctl_tcp_min_snd_mss;
+#endif
 } __randomize_layout;
 
 #include <linux/seq_file_net.h>

diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 42864bb84260b0013f9987f1d2599f9c5312a7de..953cbcfc25f6b9a56d4b872975d8ec4b4035e242 100644 (file)
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -113,7 +113,7 @@ struct netns_ipv4 {
 #endif
        int sysctl_tcp_mtu_probing;
        int sysctl_tcp_base_mss;
-       int sysctl_tcp_min_snd_mss;
+       /* int sysctl_tcp_min_snd_mss; - bwh: moved to end of struct net */
        int sysctl_tcp_probe_threshold;
        u32 sysctl_tcp_probe_interval;
 

diff --git a/include/uapi/linux/snmp.h b/include/uapi/linux/snmp.h
index abae27c3001c3d1c8295d8012628361cafc6de9c..29043919ca332af29410568b887c4c4c9c12ddbd 100644 (file)
--- a/include/uapi/linux/snmp.h
+++ b/include/uapi/linux/snmp.h
@@ -282,7 +282,9 @@ enum
        LINUX_MIB_TCPACKCOMPRESSED,             /* TCPAckCompressed */
        LINUX_MIB_TCPZEROWINDOWDROP,            /* TCPZeroWindowDrop */
        LINUX_MIB_TCPRCVQDROP,                  /* TCPRcvQDrop */
+#if !defined(__KERNEL__) || (!defined(__GENKSYMS__) && !defined(MODULE))
        LINUX_MIB_TCPWQUEUETOOBIG,              /* TCPWqueueTooBig */
+#endif
        __LINUX_MIB_MAX
 };
 

diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 297016740a4126bc0a150fb5dbea4b1c859896b8..c99129ea0b4cce027b4af96c494ce316aa9d2d38 100644 (file)
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -740,7 +740,7 @@ static struct ctl_table ipv4_net_table[] = {
        },
        {
                .procname       = "tcp_min_snd_mss",
-               .data           = &init_net.ipv4.sysctl_tcp_min_snd_mss,
+               .data           = &init_net.ipv4_sysctl_tcp_min_snd_mss,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_minmax,

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index b76cf96d5cfed973d1e9b8c45485857db8ab91a0..8ff6628b8e85aecb3f8e1800a29280f521efe784 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2527,7 +2527,7 @@ static int __net_init tcp_sk_init(struct net *net)
        net->ipv4.sysctl_tcp_ecn_fallback = 1;
 
        net->ipv4.sysctl_tcp_base_mss = TCP_BASE_MSS;
-       net->ipv4.sysctl_tcp_min_snd_mss = TCP_MIN_SND_MSS;
+       net->ipv4_sysctl_tcp_min_snd_mss = TCP_MIN_SND_MSS;
        net->ipv4.sysctl_tcp_probe_threshold = TCP_PROBE_THRESHOLD;
        net->ipv4.sysctl_tcp_probe_interval = TCP_PROBE_INTERVAL;
 

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 221d9b72423b961d948cda2659f7b86b9727438d..070a0f42e41ba9aa54e76b2077e82e62f40a7fa6 100644 (file)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1463,7 +1463,7 @@ static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu)
        mss_now -= icsk->icsk_ext_hdr_len;
 
        /* Then reserve room for full set of TCP options and 8 bytes of data */
-       mss_now = max(mss_now, sock_net(sk)->ipv4.sysctl_tcp_min_snd_mss);
+       mss_now = max(mss_now, sock_net(sk)->ipv4_sysctl_tcp_min_snd_mss);
        return mss_now;
 }
 

diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 17335a370e6452b58bd3490d6821e842d706db53..087036ec7f593a82390b0565f09d01d5ec8324c7 100644 (file)
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -166,7 +166,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
                mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1;
                mss = min(net->ipv4.sysctl_tcp_base_mss, mss);
                mss = max(mss, 68 - tcp_sk(sk)->tcp_header_len);
-               mss = max(mss, net->ipv4.sysctl_tcp_min_snd_mss);
+               mss = max(mss, net->ipv4_sysctl_tcp_min_snd_mss);
                icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss);
        }
        tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);