]> Git Repo - linux.git/commit
gso: fix udp gso fraglist segmentation after pull from frag_list
authorWillem de Bruijn <[email protected]>
Tue, 1 Oct 2024 17:17:46 +0000 (13:17 -0400)
committerJakub Kicinski <[email protected]>
Thu, 3 Oct 2024 00:29:31 +0000 (17:29 -0700)
commita1e40ac5b5e9077fe1f7ae0eb88034db0f9ae1ab
treed2f33fb4edd1ec5860f543407d389777078b3c5a
parent555f45d24ba7cd5527716553031641cdebbe76c7
gso: fix udp gso fraglist segmentation after pull from frag_list

Detect gso fraglist skbs with corrupted geometry (see below) and
pass these to skb_segment instead of skb_segment_list, as the first
can segment them correctly.

Valid SKB_GSO_FRAGLIST skbs
- consist of two or more segments
- the head_skb holds the protocol headers plus first gso_size
- one or more frag_list skbs hold exactly one segment
- all but the last must be gso_size

Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can
modify these skbs, breaking these invariants.

In extreme cases they pull all data into skb linear. For UDP, this
causes a NULL ptr deref in __udpv4_gso_segment_list_csum at
udp_hdr(seg->next)->dest.

Detect invalid geometry due to pull, by checking head_skb size.
Don't just drop, as this may blackhole a destination. Convert to be
able to pass to regular skb_segment.

Link: https://lore.kernel.org/netdev/[email protected]/
Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.")
Signed-off-by: Willem de Bruijn <[email protected]>
Cc: [email protected]
Link: https://patch.msgid.link/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
net/ipv4/udp_offload.c
This page took 0.053602 seconds and 4 git commands to generate.