udp: Fix UDP short packet false positive (7b5e56f9) · Commits · 戴 / test

The UDP header pointer assignment must happen after calling pskb_may_pull(). As pskb_may_pull() can potentially alter the SKB buffer. This was exposted by running multicast traffic through the NIU driver, as it won't prepull the protocol headers into the linear area on receive. Signed-off-by:

Jesper Dangaard Brouer <hawk@comx.dk> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/udp.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1231,7 +1231,7 @@ int __udp4_lib_rcv(struct sk_buff skb, struct udp_table udptable,
		int proto)
		{
		struct sock *sk;
		struct udphdr *uh = udp_hdr(skb);
		struct udphdr *uh;
		unsigned short ulen;
		struct rtable rt = (struct rtable)skb->dst;
		__be32 saddr = ip_hdr(skb)->saddr;
		@@ -1244,6 +1244,7 @@ int __udp4_lib_rcv(struct sk_buff skb, struct udp_table udptable,
		if (!pskb_may_pull(skb, sizeof(struct udphdr)))
		goto drop; /* No space for header. */

		uh = udp_hdr(skb);
		ulen = ntohs(uh->len);
		if (ulen > skb->len)
		goto short_packet;

Admin message