Merge branch 'GUE-error-recursion' (0c06a091) · Commits · 戴 / test

Stefano Brivio says: ==================== Fix two further potential unbounded recursions in GUE error handlers Patch 1/2 takes care of preventing the issue fixed by commit ("fou: Prevent unbounded recursion in GUE error handler") also with UDP-Lite payloads -- I just realised this might happen from a syzbot report. Patch 2/2 fixes the issue for both UDP and UDP-Lite on IPv6, which I also forgot to deal with in that same commit. ==================== Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/fou.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1065,7 +1065,8 @@ static int gue_err(struct sk_buff *skb, u32 info)
		* recursion. Besides, this kind of encapsulation can't even be
		* configured currently. Discard this.
		*/
		if (guehdr->proto_ctype == IPPROTO_UDP)
		if (guehdr->proto_ctype == IPPROTO_UDP \|\|
		guehdr->proto_ctype == IPPROTO_UDPLITE)
		return -EOPNOTSUPP;

		skb_set_transport_header(skb, -(int)sizeof(struct icmphdr));

net/ipv6/fou6.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -131,6 +131,14 @@ static int gue6_err(struct sk_buff skb, struct inet6_skb_parm opt,
		if (validate_gue_flags(guehdr, optlen))
		return -EINVAL;

		/* Handling exceptions for direct UDP encapsulation in GUE would lead to
		* recursion. Besides, this kind of encapsulation can't even be
		* configured currently. Discard this.
		*/
		if (guehdr->proto_ctype == IPPROTO_UDP \|\|
		guehdr->proto_ctype == IPPROTO_UDPLITE)
		return -EOPNOTSUPP;

		skb_set_transport_header(skb, -(int)sizeof(struct icmp6hdr));
		ret = gue6_err_proto_handler(guehdr->proto_ctype, skb,
		opt, type, code, offset, info);

Admin message