diff options
| author | Michal KubeÄek <mkubecek@suse.cz> | 2015-03-02 18:27:11 +0100 |
|---|---|---|
| committer | Stefan Bader <stefan.bader@canonical.com> | 2015-05-29 11:54:16 +0200 |
| commit | d9df18a5c5eff6d9eaedcece7bb4c60106ae1c77 (patch) | |
| tree | 2217a9b7d9c735e1b46fc18da2a10f936e2d2761 | |
| parent | b5d2cef6e2de3ab14dbcae30e5768678ab86e616 (diff) | |
| download | linux-2.6.32.y-drm33.z-d9df18a5c5eff6d9eaedcece7bb4c60106ae1c77.tar.gz | |
udp: only allow UFO for packets from SOCK_DGRAM sockets
[ Upstream commit acf8dd0a9d0b9e4cdb597c2f74802f79c699e802 ]
If an over-MTU UDP datagram is sent through a SOCK_RAW socket to a
UFO-capable device, ip_ufo_append_data() sets skb->ip_summed to
CHECKSUM_PARTIAL unconditionally as all GSO code assumes transport layer
checksum is to be computed on segmentation. However, in this case,
skb->csum_start and skb->csum_offset are never set as raw socket
transmit path bypasses udp_send_skb() where they are usually set. As a
result, driver may access invalid memory when trying to calculate the
checksum and store the result (as observed in virtio_net driver).
Moreover, the very idea of modifying the userspace provided UDP header
is IMHO against raw socket semantics (I wasn't able to find a document
clearly stating this or the opposite, though). And while allowing
CHECKSUM_NONE in the UFO case would be more efficient, it would be a bit
too intrusive change just to handle a corner case like this. Therefore
disallowing UFO for packets from SOCK_DGRAM seems to be the best option.
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
(cherry picked from commit 332640b2821f75381b1049a904d93d4fb846334f)
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
| -rw-r--r-- | net/ipv4/ip_output.c | 4 | ||||
| -rw-r--r-- | net/ipv6/ip6_output.c | 3 |
2 files changed, 4 insertions, 3 deletions
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index bd5c4b388129bd..00d4d008663090 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -877,8 +877,8 @@ int ip_append_data(struct sock *sk, inet->cork.length += length; if (((length > mtu) || (skb && skb_has_frags(skb))) && (sk->sk_protocol == IPPROTO_UDP) && - (rt->u.dst.dev->features & NETIF_F_UFO)) { - (rt->u.dst.dev->features & NETIF_F_UFO) && !rt->u.dst.header_len) { + (rt->u.dst.dev->features & NETIF_F_UFO) && !rt->u.dst.header_len && + (sk->sk_type == SOCK_DGRAM)) { err = ip_ufo_append_data(sk, getfrag, from, length, hh_len, fragheaderlen, transhdrlen, mtu, flags); diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6dff3d7835e897..193432896cb95a 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1259,7 +1259,8 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, if (((length > mtu) || (skb && skb_has_frags(skb))) && (sk->sk_protocol == IPPROTO_UDP) && - (rt->u.dst.dev->features & NETIF_F_UFO)) { + (rt->u.dst.dev->features & NETIF_F_UFO) && + (sk->sk_type == SOCK_DGRAM)) { err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len, fragheaderlen, transhdrlen, mtu, flags, rt); |