Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1462450

[PATCH 4.7 04/41] udp: use sk_filter_trim_cap for udp{,6}_queue_rcv_skb

Show all headers | View raw

4.7-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>

[ Upstream commit ba66bbe5480a012108958a71cff88b23dce84956 ]

After a612769774a3 ("udp: prevent bugcheck if filter truncates packet
too much"), there followed various other fixes for similar cases such
as f4979fcea7fd ("rose: limit sk_filter trim to payload").

Latter introduced a new helper sk_filter_trim_cap(), where we can pass
the trim limit directly to the socket filter handling. Make use of it
here as well with sizeof(struct udphdr) as lower cap limit and drop the
extra skb->len test in UDP's input path.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/udp.c |    4 +---
 net/ipv6/udp.c |    4 +---
 2 files changed, 2 insertions(+), 6 deletions(-)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1581,9 +1581,7 @@ int udp_queue_rcv_skb(struct sock *sk, s
 	    udp_lib_checksum_complete(skb))
 			goto csum_error;
 
-	if (sk_filter(sk, skb))
-		goto drop;
-	if (unlikely(skb->len < sizeof(struct udphdr)))
+	if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
 		goto drop;
 
 	udp_csum_pull_header(skb);
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -618,9 +618,7 @@ int udpv6_queue_rcv_skb(struct sock *sk,
 	    udp_lib_checksum_complete(skb))
 		goto csum_error;
 
-	if (sk_filter(sk, skb))
-		goto drop;
-	if (unlikely(skb->len < sizeof(struct udphdr)))
+	if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
 		goto drop;
 
 	udp_csum_pull_header(skb);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.7 00/41] 4.7.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200
  [PATCH 4.7 15/41] KEYS: 64-bit MIPS needs to use compat_sys_keyctl for 32-bit userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200
  [PATCH 4.7 36/41] ext4: check for extents that wrap around Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200
  [PATCH 4.7 13/41] tcp: consider recv buf for the initial window scale Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200
  [PATCH 4.7 04/41] udp: use sk_filter_trim_cap for udp{,6}_queue_rcv_skb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200
  [PATCH 4.7 34/41] crypto: scatterwalk - Fix test in scatterwalk_done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200
  [PATCH 4.7 37/41] ext4: fix deadlock during page writeback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200
  [PATCH 4.7 10/41] net/sctp: terminate rhashtable walk correctly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200
  [PATCH 4.7 35/41] serial: mvebu-uart: free the IRQ in ->shutdown() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 22:50 +0200
  [PATCH 4.7 27/41] fuse: fsync() did not return IO errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  [PATCH 4.7 19/41] mm: memcontrol: fix swap counter leak on swapout from offline cgroup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  [PATCH 4.7 03/41] vfs: fix deadlock in file_remove_privs() on overlayfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  [PATCH 4.7 29/41] fuse: fix wrong assignment of ->flags in fuse_send_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  [PATCH 4.7 21/41] x86/syscalls/64: Add compat_sys_keyctl for 32-bit userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  [PATCH 4.7 11/41] qed: Fix setting/clearing bit in completion bitmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  [PATCH 4.7 30/41] Revert "mm, mempool: only set __GFP_NOMEMALLOC if there are free elements" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  [PATCH 4.7 20/41] mm: memcontrol: fix memcg id ref counter on swap charge move Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  [PATCH 4.7 17/41] apparmor: fix ref count leak when profile sha1 hash is read Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  [PATCH 4.7 25/41] x86/microcode: Fix suspend to RAM with builtin microcode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-14 23:00 +0200
  Re: [PATCH 4.7 00/41] 4.7.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-15 10:00 +0200
    Re: [PATCH 4.7 00/41] 4.7.1-stable review Kevin Hilman <khilman@baylibre.com> - 2016-08-15 23:40 +0200
  Re: [PATCH 4.7 00/41] 4.7.1-stable review Guenter Roeck <linux@roeck-us.net> - 2016-08-15 15:10 +0200
    Re: [PATCH 4.7 00/41] 4.7.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-15 15:50 +0200
  Re: [PATCH 4.7 00/41] 4.7.1-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-08-16 06:10 +0200
    Re: [PATCH 4.7 00/41] 4.7.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-08-16 12:50 +0200

csiph-web