diff options
| author | David S. Miller <davem@davemloft.net> | 2019-01-04 13:06:07 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-01-04 13:06:07 -0800 |
| commit | 0c06a0919782cbe5f33d0f1411ca059e9bfb8190 (patch) | |
| tree | 2b47c88227cbd7d560fb44002cf62b896d8631fd | |
| parent | 41e4e2cd75346667b0c531c07dab05cce5b06d15 (diff) | |
| parent | 44039e00171b0fe930c07ff7b43e6023eaf1ed31 (diff) | |
| download | linux-0c06a0919782cbe5f33d0f1411ca059e9bfb8190.tar.bz2 | |
Merge branch 'GUE-error-recursion'
Stefano Brivio says:
====================
Fix two further potential unbounded recursions in GUE error handlers
Patch 1/2 takes care of preventing the issue fixed by commit 11789039da53
("fou: Prevent unbounded recursion in GUE error handler") also with
UDP-Lite payloads -- I just realised this might happen from a syzbot
report.
Patch 2/2 fixes the issue for both UDP and UDP-Lite on IPv6, which I also
forgot to deal with in that same commit.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv4/fou.c | 3 | ||||
| -rw-r--r-- | net/ipv6/fou6.c | 8 |
2 files changed, 10 insertions, 1 deletions
diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c index 0c9f171fb085..632863541082 100644 --- a/net/ipv4/fou.c +++ b/net/ipv4/fou.c @@ -1065,7 +1065,8 @@ static int gue_err(struct sk_buff *skb, u32 info) * recursion. Besides, this kind of encapsulation can't even be * configured currently. Discard this. */ - if (guehdr->proto_ctype == IPPROTO_UDP) + if (guehdr->proto_ctype == IPPROTO_UDP || + guehdr->proto_ctype == IPPROTO_UDPLITE) return -EOPNOTSUPP; skb_set_transport_header(skb, -(int)sizeof(struct icmphdr)); diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c index bd675c61deb1..7da7bf3b7fe3 100644 --- a/net/ipv6/fou6.c +++ b/net/ipv6/fou6.c @@ -131,6 +131,14 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (validate_gue_flags(guehdr, optlen)) return -EINVAL; + /* Handling exceptions for direct UDP encapsulation in GUE would lead to + * recursion. Besides, this kind of encapsulation can't even be + * configured currently. Discard this. + */ + if (guehdr->proto_ctype == IPPROTO_UDP || + guehdr->proto_ctype == IPPROTO_UDPLITE) + return -EOPNOTSUPP; + skb_set_transport_header(skb, -(int)sizeof(struct icmp6hdr)); ret = gue6_err_proto_handler(guehdr->proto_ctype, skb, opt, type, code, offset, info); |