diff options
| author | Xin Long <lucien.xin@gmail.com> | 2020-12-07 15:55:40 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-12-21 13:28:15 +0100 |
| commit | 41097c9c282156ca6fe5d514d2b20913648c988e (patch) | |
| tree | 92950020db64a8f0574dc9ba947077633f5d62eb | |
| parent | 8253de6c16ec05c44f1eed6b01ce1b901aee9dfb (diff) | |
| download | linux-stable-41097c9c282156ca6fe5d514d2b20913648c988e.tar.gz linux-stable-41097c9c282156ca6fe5d514d2b20913648c988e.tar.bz2 linux-stable-41097c9c282156ca6fe5d514d2b20913648c988e.zip | |
udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments
[ Upstream commit 10c678bd0a035ac2c64a9b26b222f20556227a53 ]
Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the
proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu().
Otherwize, with a negtive value passed, it will underflow inet_protos.
This can be reproduced with IPIP FOU:
# ip fou add port 5555 ipproto 4
# ethtool -K eth1 rx-gro-list on
Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection")
Reported-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/ipv4/udp.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index e88efba07551..eae3a9456fd1 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2173,7 +2173,7 @@ static int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) __skb_pull(skb, skb_transport_offset(skb)); ret = udp_queue_rcv_one_skb(sk, skb); if (ret > 0) - ip_protocol_deliver_rcu(dev_net(skb->dev), skb, -ret); + ip_protocol_deliver_rcu(dev_net(skb->dev), skb, ret); } return 0; } |