mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-04 16:24:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'GUE-error-recursion'

Browse Source 
Stefano Brivio says:

====================
Fix two further potential unbounded recursions in GUE error handlers

Patch 1/2 takes care of preventing the issue fixed by commit 11789039da
("fou: Prevent unbounded recursion in GUE error handler") also with
UDP-Lite payloads -- I just realised this might happen from a syzbot
report.

Patch 2/2 fixes the issue for both UDP and UDP-Lite on IPv6, which I also
forgot to deal with in that same commit.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller
2019-01-04 13:06:07 -08:00
parent 41e4e2cd75 44039e0017
commit 0c06a09197
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
net/ipv4/fou.c
View File

@@ -1065,7 +1065,8 @@ static int gue_err(struct sk_buff *skb, u32 info)
* recursion. Besides, this kind of encapsulation can't even be
* configured currently. Discard this.
*/
if (guehdr->proto_ctype == IPPROTO_UDP)
if (guehdr->proto_ctype == IPPROTO_UDP ||
guehdr->proto_ctype == IPPROTO_UDPLITE)
return -EOPNOTSUPP;
skb_set_transport_header(skb, -(int)sizeof(struct icmphdr));

8
net/ipv6/fou6.c
View File

@@ -131,6 +131,14 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
if (validate_gue_flags(guehdr, optlen))
return -EINVAL;
/* Handling exceptions for direct UDP encapsulation in GUE would lead to
* recursion. Besides, this kind of encapsulation can't even be
* configured currently. Discard this.
*/
if (guehdr->proto_ctype == IPPROTO_UDP ||
guehdr->proto_ctype == IPPROTO_UDPLITE)
return -EOPNOTSUPP;
skb_set_transport_header(skb, -(int)sizeof(struct icmp6hdr));
ret = gue6_err_proto_handler(guehdr->proto_ctype, skb,
opt, type, code, offset, info);