inet: frags: do not clone skb in ip_expire()

An skb_clone() was added in commit ec4fbd64751d ("inet: frag: release
spinlock before calling icmp_send()")

While fixing the bug at that time, it also added a very high cost
for DDOS frags, as the ICMP rate limit is applied after this
expensive operation (skb_clone() + consume_skb(), implying memory
allocations, copy, and freeing)

We can use skb_get(head) here, all we want is to make sure skb wont
be freed by another cpu.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 1eec5d5670084ee644597bd26c25e22c69b9f748)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 3dd19be..e235f62 100644 (file)
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -141,8 +141,8 @@ static bool frag_expire_skip_icmp(u32 user)
  */
 static void ip_expire(unsigned long arg)
 {
-       struct sk_buff *clone, *head;
        const struct iphdr *iph;
+       struct sk_buff *head;
        struct net *net;
        struct ipq *qp;
        int err;
@@ -185,16 +185,12 @@ static void ip_expire(unsigned long arg)
            (skb_rtable(head)->rt_type != RTN_LOCAL))
                goto out;
 
-       clone = skb_clone(head, GFP_ATOMIC);
+       skb_get(head);
+       spin_unlock(&qp->q.lock);
+       icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
+       kfree_skb(head);
+       goto out_rcu_unlock;
 
-       /* Send an ICMP "Fragment Reassembly Timeout" message. */
-       if (clone) {
-               spin_unlock(&qp->q.lock);
-               icmp_send(clone, ICMP_TIME_EXCEEDED,
-                         ICMP_EXC_FRAGTIME, 0);
-               consume_skb(clone);
-               goto out_rcu_unlock;
-       }
 out:
        spin_unlock(&qp->q.lock);
 out_rcu_unlock: