Commit 0f149c9f authored by Willem de Bruijn's avatar Willem de Bruijn Committed by David S. Miller
Browse files

udp: with udp_segment release on error path 



Failure __ip_append_data triggers udp_flush_pending_frames, but these
tests happen later. The skb must be freed directly.

Fixes: bec1f6f6 ("udp: generate gso with UDP_SEGMENT")
Reported-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1a935268

net/ipv4/udp.c

+12 −4
Original line number Diff line number Diff line
@@ -847,15 +847,23 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4, 
		const int hlen = skb_network_header_len(skb) +

				 sizeof(struct udphdr);



		if (hlen + cork->gso_size > cork->fragsize)

		if (hlen + cork->gso_size > cork->fragsize) {

			kfree_skb(skb);

			return -EINVAL;

		if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)

		}

		if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {

			kfree_skb(skb);

			return -EINVAL;

		if (sk->sk_no_check_tx)

		}

		if (sk->sk_no_check_tx) {

			kfree_skb(skb);

			return -EINVAL;

		}

		if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite ||

		    dst_xfrm(skb_dst(skb)))

		    dst_xfrm(skb_dst(skb))) {

			kfree_skb(skb);

			return -EIO;

		}



		skb_shinfo(skb)->gso_size = cork->gso_size;

		skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;

net/ipv6/udp.c

+12 −4
Original line number Diff line number Diff line
@@ -1132,15 +1132,23 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6, 
		const int hlen = skb_network_header_len(skb) +

				 sizeof(struct udphdr);



		if (hlen + cork->gso_size > cork->fragsize)

		if (hlen + cork->gso_size > cork->fragsize) {

			kfree_skb(skb);

			return -EINVAL;

		if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)

		}

		if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {

			kfree_skb(skb);

			return -EINVAL;

		if (udp_sk(sk)->no_check6_tx)

		}

		if (udp_sk(sk)->no_check6_tx) {

			kfree_skb(skb);

			return -EINVAL;

		}

		if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite ||

		    dst_xfrm(skb_dst(skb)))

		    dst_xfrm(skb_dst(skb))) {

			kfree_skb(skb);

			return -EIO;

		}



		skb_shinfo(skb)->gso_size = cork->gso_size;

		skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;

CRA Git | Maintained and supported by SUSTech CRA and CCSE