diff options
author | Willem de Bruijn <willemb@google.com> | 2024-10-01 13:17:46 -0400 |
---|---|---|
committer | Jakub Kicinski <kuba@kernel.org> | 2024-10-02 17:29:31 -0700 |
commit | a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab (patch) | |
tree | d2f33fb4edd1ec5860f543407d389777078b3c5a /drivers | |
parent | 555f45d24ba7cd5527716553031641cdebbe76c7 (diff) | |
download | lwn-a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab.tar.gz lwn-a1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab.zip |
gso: fix udp gso fraglist segmentation after pull from frag_list
Detect gso fraglist skbs with corrupted geometry (see below) and
pass these to skb_segment instead of skb_segment_list, as the first
can segment them correctly.
Valid SKB_GSO_FRAGLIST skbs
- consist of two or more segments
- the head_skb holds the protocol headers plus first gso_size
- one or more frag_list skbs hold exactly one segment
- all but the last must be gso_size
Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can
modify these skbs, breaking these invariants.
In extreme cases they pull all data into skb linear. For UDP, this
causes a NULL ptr deref in __udpv4_gso_segment_list_csum at
udp_hdr(seg->next)->dest.
Detect invalid geometry due to pull, by checking head_skb size.
Don't just drop, as this may blackhole a destination. Convert to be
able to pass to regular skb_segment.
Link: https://lore.kernel.org/netdev/20240428142913.18666-1-shiming.cheng@mediatek.com/
Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20241001171752.107580-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers')
0 files changed, 0 insertions, 0 deletions