| Message ID | f8ad5904d273443f4c52ce4895f6d08d0f2ed18e.1607327740.git.lucien.xin@gmail.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments | expand |
| Context | Check | Description |
|---|---|---|
| netdev/cover_letter | success | Link |
| netdev/fixes_present | success | Link |
| netdev/patch_count | success | Link |
| netdev/tree_selection | success | Clearly marked for net |
| netdev/subject_prefix | success | Link |
| netdev/source_inline | success | Was 0 now: 0 |
| netdev/verify_signedoff | success | Link |
| netdev/module_param | success | Was 0 now: 0 |
| netdev/build_32bit | success | Errors and warnings before: 9 this patch: 9 |
| netdev/kdoc | success | Errors and warnings before: 0 this patch: 0 |
| netdev/verify_fixes | success | Link |
| netdev/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 8 lines checked |
| netdev/build_allmodconfig_warn | success | Errors and warnings before: 9 this patch: 9 |
| netdev/header_inline | success | Link |
| netdev/stable | success | Stable not CCed |
From: Xin Long <lucien.xin@gmail.com> Date: Mon, 7 Dec 2020 15:55:40 +0800 > Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the > proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu(). > Otherwize, with a negtive value passed, it will underflow inet_protos. > > This can be reproduced with IPIP FOU: > > # ip fou add port 5555 ipproto 4 > # ethtool -K eth1 rx-gro-list on > > Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") > Reported-by: Guillaume Nault <gnault@redhat.com> > Signed-off-by: Xin Long <lucien.xin@gmail.com> Applied and queued up for -stable, thanks!
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 09f0a23..9eeebd4 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2173,7 +2173,7 @@ static int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) __skb_pull(skb, skb_transport_offset(skb)); ret = udp_queue_rcv_one_skb(sk, skb); if (ret > 0) - ip_protocol_deliver_rcu(dev_net(skb->dev), skb, -ret); + ip_protocol_deliver_rcu(dev_net(skb->dev), skb, ret); } return 0; }
Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu(). Otherwize, with a negtive value passed, it will underflow inet_protos. This can be reproduced with IPIP FOU: # ip fou add port 5555 ipproto 4 # ethtool -K eth1 rx-gro-list on Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") Reported-by: Guillaume Nault <gnault@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> --- net/ipv4/udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)