Commit ba66bbe5 authored Jul 25, 2016 by Daniel Borkmann Committed by David S. Miller Jul 25, 2016

udp: use sk_filter_trim_cap for udp{,6}_queue_rcv_skb



After a6127697 ("udp: prevent bugcheck if filter truncates packet
too much"), there followed various other fixes for similar cases such
as f4979fce ("rose: limit sk_filter trim to payload").

Latter introduced a new helper sk_filter_trim_cap(), where we can pass
the trim limit directly to the socket filter handling. Make use of it
here as well with sizeof(struct udphdr) as lower cap limit and drop the
extra skb->len test in UDP's input path.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent deb1f45a

net/ipv4/udp.c

+1 −3

Original line number	Diff line number	Diff line
		@@ -1581,9 +1581,7 @@ int udp_queue_rcv_skb(struct sock sk, struct sk_buff skb)
		udp_lib_checksum_complete(skb))
		goto csum_error;

		if (sk_filter(sk, skb))
		goto drop;
		if (unlikely(skb->len < sizeof(struct udphdr)))
		if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
		goto drop;

		udp_csum_pull_header(skb);

net/ipv6/udp.c

+1 −3

Original line number	Diff line number	Diff line
		@@ -618,9 +618,7 @@ int udpv6_queue_rcv_skb(struct sock sk, struct sk_buff skb)
		udp_lib_checksum_complete(skb))
		goto csum_error;

		if (sk_filter(sk, skb))
		goto drop;
		if (unlikely(skb->len < sizeof(struct udphdr)))
		if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
		goto drop;

		udp_csum_pull_header(skb);

Admin message