diff mbox series

[5.8,11/56] ip: fix tos reflection in ack and reset packets

Message ID	20200925124729.508991941@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=ikAt=DC=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Wei Wang <weiwan@google.com>, Eric Dumazet <edumazet@google.com>, "David S. Miller" <davem@davemloft.net> Subject: [PATCH 5.8 11/56] ip: fix tos reflection in ack and reset packets Date: Fri, 25 Sep 2020 14:48:01 +0200 Message-Id: <20200925124729.508991941@linuxfoundation.org> In-Reply-To: <20200925124727.878494124@linuxfoundation.org> References: <20200925124727.878494124@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.8,02/56] ibmvnic: add missing parenthesis in do_reset() [5.8,03/56] act_ife: load meta modules before tcf_idr_check_alloc() [5.8,04/56] bnxt_en: Avoid sending firmware messages when AER error is detected. [5.8,05/56] bnxt_en: Fix NULL ptr dereference crash in bnxt_fw_reset_task() [5.8,06/56] cxgb4: fix memory leak during module unload [5.8,07/56] cxgb4: Fix offset when clearing filter byte counters [5.8,08/56] geneve: add transport ports in route lookup for geneve [5.8,09/56] hdlc_ppp: add range checks in ppp_cp_parse_cr() [5.8,10/56] hinic: bump up the timeout of SET_FUNC_STATE cmd [5.8,11/56] ip: fix tos reflection in ack and reset packets [5.8,12/56] ipv4: Initialize flowi4_multipath_hash in data path [5.8,13/56] ipv4: Update exception handling for multipath routes via same device [5.8,14/56] ipv6: avoid lockdep issue in fib6_del() [5.8,15/56] net: bridge: br_vlan_get_pvid_rcu() should dereference the VLAN group under RCU [5.8,16/56] net: DCB: Validate DCB_ATTR_DCB_BUFFER argument [5.8,17/56] net: dsa: rtl8366: Properly clear member config [5.8,18/56] net: Fix bridge enslavement failure [5.8,19/56] net: ipv6: fix kconfig dependency warning for IPV6_SEG6_HMAC [5.8,20/56] net/mlx5: Fix FTE cleanup [5.8,21/56] net: phy: call phy_disable_interrupts() in phy_attach_direct() instead [5.8,22/56] net: sched: initialize with 0 before setting erspan md->u [5.8,23/56] net: sch_generic: aviod concurrent reset and enqueue op for lockless qdisc [5.8,24/56] net: sctp: Fix IPv6 ancestor_size calc in sctp_copy_descendant [5.8,25/56] nfp: use correct define to return NONE fec [5.8,26/56] taprio: Fix allowing too small intervals [5.8,27/56] tipc: Fix memory leak in tipc_group_create_member() [5.8,28/56] tipc: fix shutdown() of connection oriented socket [5.8,29/56] tipc: use skb_unshare() instead in tipc_buf_append() [5.8,30/56] net/mlx5e: Enable adding peer miss rules only if merged eswitch is supported [5.8,31/56] net/mlx5e: TLS, Do not expose FPGA TLS counter if not supported [5.8,32/56] bnxt_en: Use memcpy to copy VPD field info. [5.8,33/56] bnxt_en: return proper error codes in bnxt_show_temp [5.8,34/56] bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex. [5.8,35/56] net: lantiq: Wake TX queue again [5.8,36/56] net: lantiq: use netif_tx_napi_add() for TX NAPI [5.8,37/56] net: lantiq: Use napi_complete_done() [5.8,38/56] net: lantiq: Disable IRQs only if NAPI gets scheduled [5.8,39/56] net: phy: Avoid NPD upon phy_detach() when driver is unbound [5.8,40/56] net: phy: Do not warn in phy_stop() on PHY_DOWN [5.8,41/56] net: qrtr: check skb_put_padto() return value [5.8,42/56] net: add __must_check to skb_put_padto() [5.8,43/56] net: ethernet: ti: cpsw_new: fix suspend/resume [5.8,44/56] wireguard: noise: take lock when removing handshake entry from table [5.8,45/56] wireguard: peerlookup: take lock before checking hash in replace operation [5.8,46/56] net: ipa: fix u32_replace_bits by u32p_xxx version [5.8,47/56] net/mlx5e: Fix memory leak of tunnel info when rule under multipath not ready [5.8,48/56] hinic: fix rewaking txq after netif_tx_disable [5.8,49/56] hv_netvsc: Fix hibernation for mlx5 VF driver [5.8,50/56] net: dsa: link interfaces with the DSA master to get rid of lockdep warnings [5.8,51/56] net: dsa: microchip: ksz8795: really set the correct number of ports [5.8,52/56] net: macb: fix for pause frame receive enable bit [5.8,53/56] Revert "netns: dont disable BHs when locking "nsid_lock"" [5.8,54/56] net/mlx5e: Use RCU to protect rq->xdp_prog [5.8,55/56] net/mlx5e: Use synchronize_rcu to sync with NAPI [5.8,56/56] net/mlx5e: Fix endianness when calculating pedit mask first bit

Commit Message

gregkh@linuxfoundation.org Sept. 25, 2020, 12:48 p.m. UTC

From: Wei Wang <weiwan@google.com>

[ Upstream commit ba9e04a7ddf4f22a10e05bf9403db6b97743c7bf ]

Currently, in tcp_v4_reqsk_send_ack() and tcp_v4_send_reset(), we
echo the TOS value of the received packets in the response.
However, we do not want to echo the lower 2 ECN bits in accordance
with RFC 3168 6.1.5 robustness principles.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

Signed-off-by: Wei Wang <weiwan@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_output.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -74,6 +74,7 @@ 
 #include <net/icmp.h>
 #include <net/checksum.h>
 #include <net/inetpeer.h>
+#include <net/inet_ecn.h>
 #include <net/lwtunnel.h>
 #include <linux/bpf-cgroup.h>
 #include <linux/igmp.h>
@@ -1697,7 +1698,7 @@  void ip_send_unicast_reply(struct sock *
 	if (IS_ERR(rt))
 		return;
 
-	inet_sk(sk)->tos = arg->tos;
+	inet_sk(sk)->tos = arg->tos & ~INET_ECN_MASK;
 
 	sk->sk_protocol = ip_hdr(skb)->protocol;
 	sk->sk_bound_dev_if = arg->bound_dev_if;