Re: [PATCH 06/16 net-next v2] ipv4: udp: split IPv4 specific logic into udp_ipv4.c

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: IPv4 BIG TCP UDP support broken by length extraction truncation in udp_rcv()
--

commit 348e86f71529a8963fd2bec33bd3ebd366457c18
Author: Fernando Fernandez Mancera <fmancera@suse.de>

ipv4: udp: split IPv4 specific logic into udp_ipv4.c

This commit moves IPv4-specific UDP socket functions from the generic UDP
infrastructure into a new file, udp_ipv4.c. This change enables compiling
the INET subsystem without IPv4 support.

> diff --git a/net/ipv4/udp_ipv4.c b/net/ipv4/udp_ipv4.c
> new file mode 100644
> --- /dev/null
> +++ b/net/ipv4/udp_ipv4.c
[ ... ]
> +int udp_rcv(struct sk_buff *skb)
> +{
> +	struct rtable *rt = skb_rtable(skb);
> +	struct net *net = dev_net(skb->dev);
> +	struct sock *sk = NULL;
> +	unsigned short ulen;
> +	__be32 saddr, daddr;
> +	struct udphdr *uh;
> +	bool refcounted;
> +	int drop_reason;
[ ... ]
> +	uh   = udp_hdr(skb);
> +	ulen = ntohs(uh->len);
> +	saddr = ip_hdr(skb)->saddr;
> +	daddr = ip_hdr(skb)->daddr;
> +
> +	if (ulen > skb->len)
> +		goto short_packet;
> +
> +	if (ulen < sizeof(*uh))
> +		goto short_packet;

[Severity: High]
Does this change in udp_rcv() break support for IPv4 BIG TCP UDP packets?

By replacing the robust udp_get_len() helper with a direct ntohs(uh->len)
call and downgrading ulen to a 16-bit unsigned short, ulen evaluates to 0
for BIG TCP packets (which intentionally have uh->len set to 0).

Because ulen evaluates to 0, the subsequent bounds check (ulen < sizeof(*uh))
will evaluate as true (0 < 8), causing valid BIG TCP packets to jump to the
short_packet label and be incorrectly dropped with
SKB_DROP_REASON_PKT_TOO_SMALL.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928193046.6698-1-fmancera@suse.de?part=6