[4.19] inet: use bigger hash table for IP ID generation (backported to 4.19)
diff mbox series

Message ID 60cb0586.1c69fb81.8015b.37a1@mx.google.com
State New, archived
Headers show
Series
  • [4.19] inet: use bigger hash table for IP ID generation (backported to 4.19)
Related show

Commit Message

Amit Klein June 17, 2021, 8:19 a.m. UTC
Subject: inet: use bigger hash table for IP ID generation (backported to 4.19)
From: Amit Klein <aksecurity@gmail.com>

This is a backport to 4.19 of the following patch, originally
developed by Eric Dumazet.

In commit 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
I used a very small hash table that could be abused
by patient attackers to reveal sensitive information.

Switch to a dynamic sizing, depending on RAM size.

Typical big hosts will now use 128x more storage (2 MB)
to get a similar increase in security and reduction
of hash collisions.

As a bonus, use of alloc_large_system_hash() spreads
allocated memory among all NUMA nodes.

Fixes: 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
Reported-by: Amit Klein <aksecurity@gmail.com>
Cc: stable@vger.kernel.org
Cc: Eric Dumazet <edumazet@google.com>
Cc: Willy Tarreau <w@1wt.eu>
---
 net/ipv4/route.c | 42 ++++++++++++++++++++++++++++--------------
 1 file changed, 28 insertions(+), 14 deletions(-)

(limited to 'net/ipv4/route.c')

Comments

Greg Kroah-Hartman June 21, 2021, 3:28 p.m. UTC | #1
On Thu, Jun 17, 2021 at 01:19:18AM -0700, Amit Klein wrote:
> Subject: inet: use bigger hash table for IP ID generation (backported to 4.19)
> From: Amit Klein <aksecurity@gmail.com>
> 
> This is a backport to 4.19 of the following patch, originally
> developed by Eric Dumazet.
> 
> In commit 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
> I used a very small hash table that could be abused
> by patient attackers to reveal sensitive information.
> 
> Switch to a dynamic sizing, depending on RAM size.
> 
> Typical big hosts will now use 128x more storage (2 MB)
> to get a similar increase in security and reduction
> of hash collisions.
> 
> As a bonus, use of alloc_large_system_hash() spreads
> allocated memory among all NUMA nodes.
> 
> Fixes: 73f156a6e8c1 ("inetpeer: get rid of ip_id_count")
> Reported-by: Amit Klein <aksecurity@gmail.com>
> Cc: stable@vger.kernel.org
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Willy Tarreau <w@1wt.eu>
> ---
>  net/ipv4/route.c | 42 ++++++++++++++++++++++++++++--------------
>  1 file changed, 28 insertions(+), 14 deletions(-)
> 
> (limited to 'net/ipv4/route.c')

I had to dig up what the upstream git commit id was for this, please
specify it next time :(

I've queued this, and the 4.14 version up.  Can you create a 4.4.y and
4.9.y version as well?

thanks,

greg k-h
Amit Klein June 21, 2021, 4:01 p.m. UTC | #2
On Mon, Jun 21, 2021 at 6:28 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Thu, Jun 17, 2021 at 01:19:18AM -0700, Amit Klein wrote:
> > Subject: inet: use bigger hash table for IP ID generation (backported to 4.19)
> > From: Amit Klein <aksecurity@gmail.com>
[...]
>
> I had to dig up what the upstream git commit id was for this, please
> specify it next time :(
>

Sure. Awfully sorry about the omission.

> I've queued this, and the 4.14 version up.

Thanks.

 Can you create a 4.4.y and
> 4.9.y version as well?
>

Absolutely. I plan to do so later this week.

-Amit
Amit Klein June 22, 2021, 9:10 a.m. UTC | #3
On Mon, Jun 21, 2021 at 6:28 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Thu, Jun 17, 2021 at 01:19:18AM -0700, Amit Klein wrote:
> > Subject: inet: use bigger hash table for IP ID generation (backported to 4.19)
> > From: Amit Klein <aksecurity@gmail.com>
[...]
>
> I've queued this, and the 4.14 version up.  Can you create a 4.4.y and
> 4.9.y version as well?
>

Done and submitted (a few minutes ago). Note the subject line has
"[PATCH 4.9]" but it also fixes 4.4 (I didn't know what convention to
use for this case).

Best,
-Amit

Patch
diff mbox series

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 0470442ff61d6..ea916df1bbf5e 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -66,6 +66,7 @@ 
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
+#include <linux/bootmem.h>
 #include <linux/string.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
@@ -452,8 +453,10 @@  static void ipv4_confirm_neigh(const struct dst_entry *dst, const void *daddr)
 	__ipv4_confirm_neigh(dev, *(__force u32 *)pkey);
 }
 
-#define IP_IDENTS_SZ 2048u
-
+/* Hash tables of size 2048..262144 depending on RAM size.
+ * Each bucket uses 8 bytes.
+ */
+static u32 ip_idents_mask __read_mostly;
 static atomic_t *ip_idents __read_mostly;
 static u32 *ip_tstamps __read_mostly;
 
@@ -463,12 +466,16 @@  static u32 *ip_tstamps __read_mostly;
  */
 u32 ip_idents_reserve(u32 hash, int segs)
 {
-	u32 *p_tstamp = ip_tstamps + hash % IP_IDENTS_SZ;
-	atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
-	u32 old = READ_ONCE(*p_tstamp);
-	u32 now = (u32)jiffies;
+	u32 bucket, old, now = (u32)jiffies;
+	atomic_t *p_id;
+	u32 *p_tstamp;
 	u32 delta = 0;
 
+	bucket = hash & ip_idents_mask;
+	p_tstamp = ip_tstamps + bucket;
+	p_id = ip_idents + bucket;
+	old = READ_ONCE(*p_tstamp);
+
 	if (old != now && cmpxchg(p_tstamp, old, now) == old)
 		delta = prandom_u32_max(now - old);
 
@@ -3557,18 +3564,25 @@  struct ip_rt_acct __percpu *ip_rt_acct __read_mostly;
 
 int __init ip_rt_init(void)
 {
+	void *idents_hash;
 	int cpu;
 
-	ip_idents = kmalloc_array(IP_IDENTS_SZ, sizeof(*ip_idents),
-				  GFP_KERNEL);
-	if (!ip_idents)
-		panic("IP: failed to allocate ip_idents\n");
+	/* For modern hosts, this will use 2 MB of memory */
+	idents_hash = alloc_large_system_hash("IP idents",
+					      sizeof(*ip_idents) + sizeof(*ip_tstamps),
+					      0,
+					      16, /* one bucket per 64 KB */
+					      HASH_ZERO,
+					      NULL,
+					      &ip_idents_mask,
+					      2048,
+					      256*1024);
+
+	ip_idents = idents_hash;
 
-	prandom_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
+	prandom_bytes(ip_idents, (ip_idents_mask + 1) * sizeof(*ip_idents));
 
-	ip_tstamps = kcalloc(IP_IDENTS_SZ, sizeof(*ip_tstamps), GFP_KERNEL);
-	if (!ip_tstamps)
-		panic("IP: failed to allocate ip_tstamps\n");
+	ip_tstamps = idents_hash + (ip_idents_mask + 1) * sizeof(*ip_idents);
 
 	for_each_possible_cpu(cpu) {
 		struct uncached_list *ul = &per_cpu(rt_uncached_list, cpu);