summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTing Liu <ting.liu@nxp.com>2017-03-17 15:51:06 +0800
committerOtavio Salvador <otavio@ossystems.com.br>2017-03-17 17:04:04 -0300
commit7cbee3a8d8f99476493ba634db9ff9228f08ee16 (patch)
treeaffd1faa99e6a7e1b41d555e65db51406a07f109
parenta192c90bcef4109d2a3826eaa7159b0b22411ecf (diff)
downloadmeta-freescale-7cbee3a8d8f99476493ba634db9ff9228f08ee16.tar.gz
linux-qoriq: update to b14540e
* merged upstream v4.1.35 release. * support LS1012A * Includes additional workarounds for Chip Errata: A-010284, A-010150, A-008975 Signed-off-by: Zhenhua Luo <zhenhua.luo@nxp.com> Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
-rw-r--r--recipes-kernel/linux/linux-qoriq/CVE-2016-5696-limiting-of-all-challenge.patch111
-rw-r--r--recipes-kernel/linux/linux-qoriq/CVE-2016-5696-make-challenge-acks-less-predictable.patch90
-rw-r--r--recipes-kernel/linux/linux-qoriq_4.1.bb5
3 files changed, 2 insertions, 204 deletions
diff --git a/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-limiting-of-all-challenge.patch b/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-limiting-of-all-challenge.patch
deleted file mode 100644
index d1f97cd5..00000000
--- a/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-limiting-of-all-challenge.patch
+++ /dev/null
@@ -1,111 +0,0 @@
1From 5413f1a526d2d51d7a5768133c90936c017165c6 Mon Sep 17 00:00:00 2001
2From: Jason Baron <jbaron@akamai.com>
3Date: Thu, 14 Jul 2016 11:38:40 -0400
4Subject: [PATCH] tcp: enable per-socket rate limiting of all 'challenge acks'
5
6[ Upstream commit 083ae308280d13d187512b9babe3454342a7987e ]
7
8The per-socket rate limit for 'challenge acks' was introduced in the
9context of limiting ack loops:
10
11commit f2b2c582e824 ("tcp: mitigate ACK loops for connections as tcp_sock")
12
13And I think it can be extended to rate limit all 'challenge acks' on a
14per-socket basis.
15
16Since we have the global tcp_challenge_ack_limit, this patch allows for
17tcp_challenge_ack_limit to be set to a large value and effectively rely on
18the per-socket limit, or set tcp_challenge_ack_limit to a lower value and
19still prevents a single connections from consuming the entire challenge ack
20quota.
21
22It further moves in the direction of eliminating the global limit at some
23point, as Eric Dumazet has suggested. This a follow-up to:
24Subject: tcp: make challenge acks less predictable
25
26CVE: CVE-2016-5696
27Upstream-Status: Backport
28
29Cc: Eric Dumazet <edumazet@google.com>
30Cc: David S. Miller <davem@davemloft.net>
31Cc: Neal Cardwell <ncardwell@google.com>
32Cc: Yuchung Cheng <ycheng@google.com>
33Cc: Yue Cao <ycao009@ucr.edu>
34Signed-off-by: Jason Baron <jbaron@akamai.com>
35Signed-off-by: David S. Miller <davem@davemloft.net>
36Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
37Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
38Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>
39
40---
41 net/ipv4/tcp_input.c | 39 ++++++++++++++++++++++-----------------
42 1 file changed, 22 insertions(+), 17 deletions(-)
43
44diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
45index 05f10df..12b98e2 100644
46--- a/net/ipv4/tcp_input.c
47+++ b/net/ipv4/tcp_input.c
48@@ -3390,6 +3390,23 @@ static int tcp_ack_update_window(struct sock *sk, const struct sk_buff *skb, u32
49 return flag;
50 }
51
52+static bool __tcp_oow_rate_limited(struct net *net, int mib_idx,
53+ u32 *last_oow_ack_time)
54+{
55+ if (*last_oow_ack_time) {
56+ s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time);
57+
58+ if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
59+ NET_INC_STATS_BH(net, mib_idx);
60+ return true; /* rate-limited: don't send yet! */
61+ }
62+ }
63+
64+ *last_oow_ack_time = tcp_time_stamp;
65+
66+ return false; /* not rate-limited: go ahead, send dupack now! */
67+}
68+
69 /* Return true if we're currently rate-limiting out-of-window ACKs and
70 * thus shouldn't send a dupack right now. We rate-limit dupacks in
71 * response to out-of-window SYNs or ACKs to mitigate ACK loops or DoS
72@@ -3403,21 +3420,9 @@ bool tcp_oow_rate_limited(struct net *net, const struct sk_buff *skb,
73 /* Data packets without SYNs are not likely part of an ACK loop. */
74 if ((TCP_SKB_CB(skb)->seq != TCP_SKB_CB(skb)->end_seq) &&
75 !tcp_hdr(skb)->syn)
76- goto not_rate_limited;
77-
78- if (*last_oow_ack_time) {
79- s32 elapsed = (s32)(tcp_time_stamp - *last_oow_ack_time);
80-
81- if (0 <= elapsed && elapsed < sysctl_tcp_invalid_ratelimit) {
82- NET_INC_STATS_BH(net, mib_idx);
83- return true; /* rate-limited: don't send yet! */
84- }
85- }
86-
87- *last_oow_ack_time = tcp_time_stamp;
88+ return false;
89
90-not_rate_limited:
91- return false; /* not rate-limited: go ahead, send dupack now! */
92+ return __tcp_oow_rate_limited(net, mib_idx, last_oow_ack_time);
93 }
94
95 /* RFC 5961 7 [ACK Throttling] */
96@@ -3430,9 +3435,9 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
97 u32 count, now;
98
99 /* First check our per-socket dupack rate limit. */
100- if (tcp_oow_rate_limited(sock_net(sk), skb,
101- LINUX_MIB_TCPACKSKIPPEDCHALLENGE,
102- &tp->last_oow_ack_time))
103+ if (__tcp_oow_rate_limited(sock_net(sk),
104+ LINUX_MIB_TCPACKSKIPPEDCHALLENGE,
105+ &tp->last_oow_ack_time))
106 return;
107
108 /* Then check host-wide RFC 5961 rate limit. */
109--
1101.9.1
111
diff --git a/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-make-challenge-acks-less-predictable.patch b/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-make-challenge-acks-less-predictable.patch
deleted file mode 100644
index 072671a2..00000000
--- a/recipes-kernel/linux/linux-qoriq/CVE-2016-5696-make-challenge-acks-less-predictable.patch
+++ /dev/null
@@ -1,90 +0,0 @@
1From 72c2d3bccaba4a0a4de354f9d2d24eccd05bfccf Mon Sep 17 00:00:00 2001
2From: Eric Dumazet <edumazet@google.com>
3Date: Sun, 10 Jul 2016 10:04:02 +0200
4Subject: [PATCH] tcp: make challenge acks less predictable
5
6[ Upstream commit 75ff39ccc1bd5d3c455b6822ab09e533c551f758 ]
7
8Yue Cao claims that current host rate limiting of challenge ACKS
9(RFC 5961) could leak enough information to allow a patient attacker
10to hijack TCP sessions. He will soon provide details in an academic
11paper.
12
13This patch increases the default limit from 100 to 1000, and adds
14some randomization so that the attacker can no longer hijack
15sessions without spending a considerable amount of probes.
16
17Based on initial analysis and patch from Linus.
18
19Note that we also have per socket rate limiting, so it is tempting
20to remove the host limit in the future.
21
22v2: randomize the count of challenge acks per second, not the period.
23
24CVE: CVE-2016-5696
25Upstream-Status: Backport
26
27Fixes: 282f23c6ee34 ("tcp: implement RFC 5961 3.2")
28Reported-by: Yue Cao <ycao009@ucr.edu>
29Signed-off-by: Eric Dumazet <edumazet@google.com>
30Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
31Cc: Yuchung Cheng <ycheng@google.com>
32Cc: Neal Cardwell <ncardwell@google.com>
33Acked-by: Neal Cardwell <ncardwell@google.com>
34Acked-by: Yuchung Cheng <ycheng@google.com>
35Signed-off-by: David S. Miller <davem@davemloft.net>
36Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
37Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
38Signed-off-by: Adrian Dudau <adrian.dudau@enea.com>
39
40---
41 net/ipv4/tcp_input.c | 15 ++++++++++-----
42 1 file changed, 10 insertions(+), 5 deletions(-)
43
44diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
45index d4c5115..05f10df 100644
46--- a/net/ipv4/tcp_input.c
47+++ b/net/ipv4/tcp_input.c
48@@ -89,7 +89,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1;
49 EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
50
51 /* rfc5961 challenge ack rate limiting */
52-int sysctl_tcp_challenge_ack_limit = 100;
53+int sysctl_tcp_challenge_ack_limit = 1000;
54
55 int sysctl_tcp_stdurg __read_mostly;
56 int sysctl_tcp_rfc1337 __read_mostly;
57@@ -3427,7 +3427,7 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
58 static u32 challenge_timestamp;
59 static unsigned int challenge_count;
60 struct tcp_sock *tp = tcp_sk(sk);
61- u32 now;
62+ u32 count, now;
63
64 /* First check our per-socket dupack rate limit. */
65 if (tcp_oow_rate_limited(sock_net(sk), skb,
66@@ -3435,13 +3435,18 @@ static void tcp_send_challenge_ack(struct sock *sk, const struct sk_buff *skb)
67 &tp->last_oow_ack_time))
68 return;
69
70- /* Then check the check host-wide RFC 5961 rate limit. */
71+ /* Then check host-wide RFC 5961 rate limit. */
72 now = jiffies / HZ;
73 if (now != challenge_timestamp) {
74+ u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
75+
76 challenge_timestamp = now;
77- challenge_count = 0;
78+ WRITE_ONCE(challenge_count, half +
79+ prandom_u32_max(sysctl_tcp_challenge_ack_limit));
80 }
81- if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
82+ count = READ_ONCE(challenge_count);
83+ if (count > 0) {
84+ WRITE_ONCE(challenge_count, count - 1);
85 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
86 tcp_send_ack(sk);
87 }
88--
891.9.1
90
diff --git a/recipes-kernel/linux/linux-qoriq_4.1.bb b/recipes-kernel/linux/linux-qoriq_4.1.bb
index 587ecd9d..6c2b2351 100644
--- a/recipes-kernel/linux/linux-qoriq_4.1.bb
+++ b/recipes-kernel/linux/linux-qoriq_4.1.bb
@@ -13,12 +13,10 @@ SRC_URI = "git://git.freescale.com/ppc/sdk/linux.git;nobranch=1 \
13 file://fix-the-compile-issue-under-gcc6.patch \ 13 file://fix-the-compile-issue-under-gcc6.patch \
14 file://only-set-vmpic_msi_feature-if-CONFIG_EPAPR_PARAVIRT-.patch \ 14 file://only-set-vmpic_msi_feature-if-CONFIG_EPAPR_PARAVIRT-.patch \
15 file://powerpc-fsl-Fix-build-of-the-dtb-embedded-kernel-images.patch \ 15 file://powerpc-fsl-Fix-build-of-the-dtb-embedded-kernel-images.patch \
16 file://CVE-2016-5696-limiting-of-all-challenge.patch \
17 file://CVE-2016-5696-make-challenge-acks-less-predictable.patch \
18 file://CVE-2016-2053.patch \ 16 file://CVE-2016-2053.patch \
19 file://CVE-2016-0758.patch \ 17 file://CVE-2016-0758.patch \
20" 18"
21SRCREV = "4004071c129a776136e71f6a85383fea87f5db75" 19SRCREV = "b14540ee315f79f6a5dfc621e7f4217c8fac7d1c"
22 20
23S = "${WORKDIR}/git" 21S = "${WORKDIR}/git"
24 22
@@ -37,6 +35,7 @@ SCMVERSION ?= "y"
37LOCALVERSION = "" 35LOCALVERSION = ""
38DELTA_KERNEL_DEFCONFIG ?= "" 36DELTA_KERNEL_DEFCONFIG ?= ""
39DELTA_KERNEL_DEFCONFIG_prepend_qoriq-arm64 = "freescale.config " 37DELTA_KERNEL_DEFCONFIG_prepend_qoriq-arm64 = "freescale.config "
38DELTA_KERNEL_DEFCONFIG_prepend_fsl-lsch2-32b = "freescale_aarch32.config "
40 39
41do_merge_delta_config() { 40do_merge_delta_config() {
42 # copy desired defconfig so we pick it up for the real kernel_do_configure 41 # copy desired defconfig so we pick it up for the real kernel_do_configure