| Message ID | f8ad5904d273443f4c52ce4895f6d08d0f2ed18e.1607327740.git.lucien.xin@gmail.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [net] udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments | expand |
From: Xin Long <lucien.xin@gmail.com> Date: Mon, 7 Dec 2020 15:55:40 +0800 > Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the > proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu(). > Otherwize, with a negtive value passed, it will underflow inet_protos. > > This can be reproduced with IPIP FOU: > > # ip fou add port 5555 ipproto 4 > # ethtool -K eth1 rx-gro-list on > > Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") > Reported-by: Guillaume Nault <gnault@redhat.com> > Signed-off-by: Xin Long <lucien.xin@gmail.com> Applied and queued up for -stable, thanks!
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 09f0a23..9eeebd4 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2173,7 +2173,7 @@ static int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) __skb_pull(skb, skb_transport_offset(skb)); ret = udp_queue_rcv_one_skb(sk, skb); if (ret > 0) - ip_protocol_deliver_rcu(dev_net(skb->dev), skb, -ret); + ip_protocol_deliver_rcu(dev_net(skb->dev), skb, ret); } return 0; }
Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu(). Otherwize, with a negtive value passed, it will underflow inet_protos. This can be reproduced with IPIP FOU: # ip fou add port 5555 ipproto 4 # ethtool -K eth1 rx-gro-list on Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") Reported-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> --- net/ipv4/udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)