From: Eric Dumazet edumazet@google.com
stable inclusion from stable-v5.10.125 commit 743acb520799bd8987edb7d1282b7eeddeb8f986 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5L6EY
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...
--------------------------------
commit c579bd1b4021c42ae247108f1e6f73dd3f08600c upstream.
Even when implementing RFC 6056 3.3.4 (Algorithm 4: Double-Hash Port Selection Algorithm), a patient attacker could still be able to collect enough state from an otherwise idle host.
Idea of this patch is to inject some noise, in the cases __inet_hash_connect() found a candidate in the first attempt.
This noise should not significantly reduce the collision avoidance, and should be zero if connection table is already well used.
Note that this is not implementing RFC 6056 3.3.5 because we think Algorithm 5 could hurt typical workloads.
Signed-off-by: Eric Dumazet edumazet@google.com Cc: David Dworken ddworken@google.com Cc: Willem de Bruijn willemb@google.com Signed-off-by: David S. Miller davem@davemloft.net Cc: Ben Hutchings ben@decadent.org.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org Signed-off-by: Zheng Zengkai zhengzengkai@huawei.com Reviewed-by: Wei Li liwei391@huawei.com --- net/ipv4/inet_hashtables.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index 2bb9ded807ee..aadafcf7358b 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -833,6 +833,11 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, return -EADDRNOTAVAIL;
ok: + /* If our first attempt found a candidate, skip next candidate + * in 1/16 of cases to add some noise. + */ + if (!i && !(prandom_u32() % 16)) + i = 2; WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2);
/* Head lock still held and bh's disabled */