tcp: CVE-2019-11479

tcp: add tcp_min_snd_mss sysctl
tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()

References:
https://nvd.nist.gov/vuln/detail/CVE-2019-11479
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=8e39cbc03dafa3731d22533f869bf326c0e6e6f8
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=7e9096287352d0416f3caa0919c90bd9ed2f68d3

Change-Id: I75cade9036c762b5a2cc4512b87fcf96a66f11a0
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

3 files changed, 190 insertions, 0 deletions

diff --git a/patches/cve/4.9.x.scc b/patches/cve/4.9.x.scc
index ad03493..18412cb 100644
--- a/patches/cve/4.9.x.scc
+++ b/patches/cve/4.9.x.scc
@@ -48,3 +48,5 @@ patch CVE-2018-20836-scsi-libsas-fix-a-race-condition-when-smp-task-timeo.patch
 patch CVE-2019-11477-tcp-limit-payload-size-of-sacked-skbs.patch
 patch CVE-2019-11478-tcp-tcp_fragment-should-apply-sane-memory-limits.patch
 patch CVE-2019-11478-tcp-refine-memory-limit-test-in-tcp_fragment.patch
+patch CVE-2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch
+patch CVE-2019-11479-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch
diff --git a/patches/cve/CVE-2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch b/patches/cve/CVE-2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch
new file mode 100644
index 0000000..9cb6467
--- /dev/null
+++ b/patches/cve/CVE-2019-11479-tcp-add-tcp_min_snd_mss-sysctl.patch
@@ -0,0 +1,142 @@
+From 8e39cbc03dafa3731d22533f869bf326c0e6e6f8 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 15 Jun 2019 17:44:24 -0700
+Subject: [PATCH] tcp: add tcp_min_snd_mss sysctl
+
+commit 5f3e2bf008c2221478101ee72f5cb4654b9fc363 upstream.
+
+Some TCP peers announce a very small MSS option in their SYN and/or
+SYN/ACK messages.
+
+This forces the stack to send packets with a very high network/cpu
+overhead.
+
+Linux has enforced a minimal value of 48. Since this value includes
+the size of TCP options, and that the options can consume up to 40
+bytes, this means that each segment can include only 8 bytes of payload.
+
+In some cases, it can be useful to increase the minimal value
+to a saner value.
+
+We still let the default to 48 (TCP_MIN_SND_MSS), for compatibility
+reasons.
+
+Note that TCP_MAXSEG socket option enforces a minimal value
+of (TCP_MIN_MSS). David Miller increased this minimal value
+in commit c39508d6f118 ("tcp: Make TCP_MAXSEG minimum more correct.")
+from 64 to 88.
+
+We might in the future merge TCP_MIN_SND_MSS and TCP_MIN_MSS.
+
+CVE-2019-11479 -- tcp mss hardcoded to 48
+
+CVE: CVE-2019-11479
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=8e39cbc03dafa3731d22533f869bf326c0e6e6f8]
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Suggested-by: Jonathan Looney <jtl@netflix.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: Tyler Hicks <tyhicks@canonical.com>
+Cc: Bruce Curtis <brucec@netflix.com>
+Cc: Jonathan Lemon <jonathan.lemon@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ Documentation/networking/ip-sysctl.txt |  8 ++++++++
+ include/net/netns/ipv4.h               |  1 +
+ net/ipv4/sysctl_net_ipv4.c             | 11 +++++++++++
+ net/ipv4/tcp_ipv4.c                    |  1 +
+ net/ipv4/tcp_output.c                  |  3 +--
+ 5 files changed, 22 insertions(+), 2 deletions(-)
+
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index 0335285f3918..49935d5bb5c6 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -230,6 +230,14 @@ tcp_base_mss - INTEGER
+        Path MTU discovery (MTU probing).  If MTU probing is enabled,
+        this is the initial MSS used by the connection.
+ 
++tcp_min_snd_mss - INTEGER
++       TCP SYN and SYNACK messages usually advertise an ADVMSS option,
++       as described in RFC 1122 and RFC 6691.
++       If this ADVMSS option is smaller than tcp_min_snd_mss,
++       it is silently capped to tcp_min_snd_mss.
++
++       Default : 48 (at least 8 bytes of payload per segment)
++
+ tcp_congestion_control - STRING
+        Set the congestion control algorithm to be used for new
+        connections. The algorithm "reno" is always available, but
+diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
+index 7adf4386ac8f..bf619a67ec03 100644
+--- a/include/net/netns/ipv4.h
++++ b/include/net/netns/ipv4.h
+@@ -94,6 +94,7 @@ struct netns_ipv4 {
+ #endif
+        int sysctl_tcp_mtu_probing;
+        int sysctl_tcp_base_mss;
++       int sysctl_tcp_min_snd_mss;
+        int sysctl_tcp_probe_threshold;
+        u32 sysctl_tcp_probe_interval;
+ 
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 85713adf2770..e202babb14d6 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -35,6 +35,8 @@ static int ip_local_port_range_min[] = { 1, 1 };
+ static int ip_local_port_range_max[] = { 65535, 65535 };
+ static int tcp_adv_win_scale_min = -31;
+ static int tcp_adv_win_scale_max = 31;
++static int tcp_min_snd_mss_min = TCP_MIN_SND_MSS;
++static int tcp_min_snd_mss_max = 65535;
+ static int ip_ttl_min = 1;
+ static int ip_ttl_max = 255;
+ static int tcp_syn_retries_min = 1;
+@@ -838,6 +840,15 @@ static struct ctl_table ipv4_net_table[] = {
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec,
+        },
++       {
++               .procname       = "tcp_min_snd_mss",
++               .data           = &init_net.ipv4.sysctl_tcp_min_snd_mss,
++               .maxlen         = sizeof(int),
++               .mode           = 0644,
++               .proc_handler   = proc_dointvec_minmax,
++               .extra1         = &tcp_min_snd_mss_min,
++               .extra2         = &tcp_min_snd_mss_max,
++       },
+        {
+                .procname       = "tcp_probe_threshold",
+                .data           = &init_net.ipv4.sysctl_tcp_probe_threshold,
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 82c1064ff4aa..848f2c1da8a5 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -2456,6 +2456,7 @@ static int __net_init tcp_sk_init(struct net *net)
+        net->ipv4.sysctl_tcp_ecn_fallback = 1;
+ 
+        net->ipv4.sysctl_tcp_base_mss = TCP_BASE_MSS;
++       net->ipv4.sysctl_tcp_min_snd_mss = TCP_MIN_SND_MSS;
+        net->ipv4.sysctl_tcp_probe_threshold = TCP_PROBE_THRESHOLD;
+        net->ipv4.sysctl_tcp_probe_interval = TCP_PROBE_INTERVAL;
+ 
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 123b2d8fde46..d8c6b833f0ce 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1360,8 +1360,7 @@ static inline int __tcp_mtu_to_mss(struct sock *sk, int pmtu)
+        mss_now -= icsk->icsk_ext_hdr_len;
+ 
+        /* Then reserve room for full set of TCP options and 8 bytes of data */
+-       if (mss_now < TCP_MIN_SND_MSS)
+-               mss_now = TCP_MIN_SND_MSS;
++       mss_now = max(mss_now, sock_net(sk)->ipv4.sysctl_tcp_min_snd_mss);
+        return mss_now;
+ }
+ 
+-- 
+2.20.1
+
diff --git a/patches/cve/CVE-2019-11479-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch b/patches/cve/CVE-2019-11479-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch
new file mode 100644
index 0000000..5576fcf
--- /dev/null
+++ b/patches/cve/CVE-2019-11479-tcp-enforce-tcp_min_snd_mss-in-tcp_mtu_probing.patch
@@ -0,0 +1,46 @@
+From 7e9096287352d0416f3caa0919c90bd9ed2f68d3 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 15 Jun 2019 17:47:27 -0700
+Subject: [PATCH] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
+
+commit 967c05aee439e6e5d7d805e195b3a20ef5c433d6 upstream.
+
+If mtu probing is enabled tcp_mtu_probing() could very well end up
+with a too small MSS.
+
+Use the new sysctl tcp_min_snd_mss to make sure MSS search
+is performed in an acceptable range.
+
+CVE-2019-11479 -- tcp mss hardcoded to 48
+
+CVE: CVE-2019-11479 fix
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.9.y&id=7e9096287352d0416f3caa0919c90bd9ed2f68d3]
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Jonathan Lemon <jonathan.lemon@gmail.com>
+Cc: Jonathan Looney <jtl@netflix.com>
+Acked-by: Neal Cardwell <ncardwell@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Cc: Tyler Hicks <tyhicks@canonical.com>
+Cc: Bruce Curtis <brucec@netflix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ net/ipv4/tcp_timer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
+index 69523389f067..d9e364c4863a 100644
+--- a/net/ipv4/tcp_timer.c
++++ b/net/ipv4/tcp_timer.c
+@@ -140,6 +140,7 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
+                        mss = tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_low) >> 1;
+                        mss = min(net->ipv4.sysctl_tcp_base_mss, mss);
+                        mss = max(mss, 68 - tp->tcp_header_len);
++                       mss = max(mss, net->ipv4.sysctl_tcp_min_snd_mss);
+                        icsk->icsk_mtup.search_low = tcp_mss_to_mtu(sk, mss);
+                        tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
+                }
+-- 
+2.20.1