From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:54081 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1161075AbcFQPg2 (ORCPT ); Fri, 17 Jun 2016 11:36:28 -0400 Subject: Patch "udp: prevent skbs lingering in tunnel socket queues" has been added to the 4.6-stable tree To: hannes@stressinduktion.org, davem@davemloft.net, gregkh@linuxfoundation.org Cc: , From: Date: Fri, 17 Jun 2016 08:36:27 -0700 Message-ID: <146617778717524@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled udp: prevent skbs lingering in tunnel socket queues to the 4.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: udp-prevent-skbs-lingering-in-tunnel-socket-queues.patch and it can be found in the queue-4.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Fri Jun 17 08:34:39 PDT 2016 From: Hannes Frederic Sowa Date: Thu, 19 May 2016 15:58:33 +0200 Subject: udp: prevent skbs lingering in tunnel socket queues From: Hannes Frederic Sowa [ Upstream commit e5aed006be918af163eb397e45aa5ea6cefd5e01 ] In case we find a socket with encapsulation enabled we should call the encap_recv function even if just a udp header without payload is available. The callbacks are responsible for correctly verifying and dropping the packets. Also, in case the header validation fails for geneve and vxlan we shouldn't put the skb back into the socket queue, no one will pick them up there. Instead we can simply discard them in the respective encap_recv functions. Signed-off-by: Hannes Frederic Sowa Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/geneve.c | 10 +++------- drivers/net/vxlan.c | 4 ++-- net/ipv4/udp.c | 2 +- net/ipv6/udp.c | 2 +- 4 files changed, 7 insertions(+), 11 deletions(-) --- a/drivers/net/geneve.c +++ b/drivers/net/geneve.c @@ -336,15 +336,15 @@ static int geneve_udp_encap_recv(struct /* Need Geneve and inner Ethernet header to be present */ if (unlikely(!pskb_may_pull(skb, GENEVE_BASE_HLEN))) - goto error; + goto drop; /* Return packets with reserved bits set */ geneveh = geneve_hdr(skb); if (unlikely(geneveh->ver != GENEVE_VER)) - goto error; + goto drop; if (unlikely(geneveh->proto_type != htons(ETH_P_TEB))) - goto error; + goto drop; gs = rcu_dereference_sk_user_data(sk); if (!gs) @@ -367,10 +367,6 @@ drop: /* Consume bad packet */ kfree_skb(skb); return 0; - -error: - /* Let the UDP layer deal with the skb */ - return 1; } static struct socket *geneve_create_sock(struct net *net, bool ipv6, --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -1262,7 +1262,7 @@ static int vxlan_rcv(struct sock *sk, st /* Need Vxlan and inner Ethernet header to be present */ if (!pskb_may_pull(skb, VXLAN_HLEN)) - return 1; + goto drop; unparsed = *vxlan_hdr(skb); /* VNI flag always required to be set */ @@ -1271,7 +1271,7 @@ static int vxlan_rcv(struct sock *sk, st ntohl(vxlan_hdr(skb)->vx_flags), ntohl(vxlan_hdr(skb)->vx_vni)); /* Return non vxlan pkt */ - return 1; + goto drop; } unparsed.vx_flags &= ~VXLAN_HF_VNI; unparsed.vx_vni &= ~VXLAN_VNI_MASK; --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1616,7 +1616,7 @@ int udp_queue_rcv_skb(struct sock *sk, s /* if we're overly short, let UDP handle it */ encap_rcv = ACCESS_ONCE(up->encap_rcv); - if (skb->len > sizeof(struct udphdr) && encap_rcv) { + if (encap_rcv) { int ret; /* Verify checksum before giving to encap */ --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -653,7 +653,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, /* if we're overly short, let UDP handle it */ encap_rcv = ACCESS_ONCE(up->encap_rcv); - if (skb->len > sizeof(struct udphdr) && encap_rcv) { + if (encap_rcv) { int ret; /* Verify checksum before giving to encap */ Patches currently in stable-queue which might be from hannes@stressinduktion.org are queue-4.6/ipv6-skip-xfrm-lookup-if-dst_entry-in-socket-cache-is-valid.patch queue-4.6/bpf-use-mount_nodev-not-mount_ns-to-mount-the-bpf-filesystem.patch queue-4.6/udp-prevent-skbs-lingering-in-tunnel-socket-queues.patch queue-4.6/bpf-inode-disallow-userns-mounts.patch