Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S937465AbdCJNdJ (ORCPT ); Fri, 10 Mar 2017 08:33:09 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:43683 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934381AbdCJLw3 (ORCPT ); Fri, 10 Mar 2017 06:52:29 -0500 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Hannes Frederic Sowa" , "David S. Miller" Date: Fri, 10 Mar 2017 11:46:23 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 318/370] udp: prevent skbs lingering in tunnel socket queues In-Reply-To: X-SA-Exim-Connect-IP: 82.70.136.246 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2473 Lines: 78 3.16.42-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Hannes Frederic Sowa [ Upstream commit e5aed006be918af163eb397e45aa5ea6cefd5e01 ] In case we find a socket with encapsulation enabled we should call the encap_recv function even if just a udp header without payload is available. The callbacks are responsible for correctly verifying and dropping the packets. Also, in case the header validation fails for geneve and vxlan we shouldn't put the skb back into the socket queue, no one will pick them up there. Instead we can simply discard them in the respective encap_recv functions. Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller [bwh: Backported to 3.16: - Drop changes to geneve - vxlan error checking looked a bit different] Signed-off-by: Ben Hutchings --- --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -1146,7 +1146,7 @@ static int vxlan_udp_encap_recv(struct s /* Need Vxlan and inner Ethernet header to be present */ if (!pskb_may_pull(skb, VXLAN_HLEN)) - goto error; + goto drop; /* Return packets with reserved bits set */ vxh = (struct vxlanhdr *)(udp_hdr(skb) + 1); @@ -1154,7 +1154,7 @@ static int vxlan_udp_encap_recv(struct s (vxh->vx_vni & htonl(0xff))) { netdev_dbg(skb->dev, "invalid vxlan flags=%#x vni=%#x\n", ntohl(vxh->vx_flags), ntohl(vxh->vx_vni)); - goto error; + goto drop; } if (iptunnel_pull_header(skb, VXLAN_HLEN, htons(ETH_P_TEB))) @@ -1173,10 +1173,6 @@ drop: /* Consume bad packet */ kfree_skb(skb); return 0; - -error: - /* Return non vxlan pkt */ - return 1; } static void vxlan_rcv(struct vxlan_sock *vs, --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1533,7 +1533,7 @@ int udp_queue_rcv_skb(struct sock *sk, s /* if we're overly short, let UDP handle it */ encap_rcv = ACCESS_ONCE(up->encap_rcv); - if (skb->len > sizeof(struct udphdr) && encap_rcv != NULL) { + if (encap_rcv) { int ret; /* Verify checksum before giving to encap */ --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -631,7 +631,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, /* if we're overly short, let UDP handle it */ encap_rcv = ACCESS_ONCE(up->encap_rcv); - if (skb->len > sizeof(struct udphdr) && encap_rcv != NULL) { + if (encap_rcv) { int ret; /* Verify checksum before giving to encap */