From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from wtarreau.pck.nerim.net ([62.212.114.60]:36249 "EHLO 1wt.eu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934167AbbEOIQG (ORCPT ); Fri, 15 May 2015 04:16:06 -0400 Message-Id: <20150515080531.605178859@1wt.eu> Date: Fri, 15 May 2015 10:06:01 +0200 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Michal Kubecek , "David S. Miller" , Ben Hutchings , Willy Tarreau Subject: [ 31/48] udp: only allow UFO for packets from SOCK_DGRAM sockets MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 In-Reply-To: <9c2783dfae10ef2d1e9b08bcc1e562c5@local> Sender: stable-owner@vger.kernel.org List-ID: 2.6.32-longterm review patch. If anyone has any objections, please let me know. ------------------ From: =?latin1?q?Michal=20Kube=C4=8Dek?= [ Upstream commit acf8dd0a9d0b9e4cdb597c2f74802f79c699e802 ] If an over-MTU UDP datagram is sent through a SOCK_RAW socket to a UFO-capable device, ip_ufo_append_data() sets skb->ip_summed to CHECKSUM_PARTIAL unconditionally as all GSO code assumes transport layer checksum is to be computed on segmentation. However, in this case, skb->csum_start and skb->csum_offset are never set as raw socket transmit path bypasses udp_send_skb() where they are usually set. As a result, driver may access invalid memory when trying to calculate the checksum and store the result (as observed in virtio_net driver). Moreover, the very idea of modifying the userspace provided UDP header is IMHO against raw socket semantics (I wasn't able to find a document clearly stating this or the opposite, though). And while allowing CHECKSUM_NONE in the UFO case would be more efficient, it would be a bit too intrusive change just to handle a corner case like this. Therefore disallowing UFO for packets from SOCK_DGRAM seems to be the best option. Signed-off-by: Michal Kubecek Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings (cherry picked from commit 332640b2821f75381b1049a904d93d4fb846334f) Signed-off-by: Willy Tarreau --- net/ipv4/ip_output.c | 4 ++-- net/ipv6/ip6_output.c | 3 ++- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index bd5c4b3..00d4d00 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -877,8 +877,8 @@ int ip_append_data(struct sock *sk, inet->cork.length += length; if (((length > mtu) || (skb && skb_has_frags(skb))) && (sk->sk_protocol == IPPROTO_UDP) && - (rt->u.dst.dev->features & NETIF_F_UFO)) { - (rt->u.dst.dev->features & NETIF_F_UFO) && !rt->u.dst.header_len) { + (rt->u.dst.dev->features & NETIF_F_UFO) && !rt->u.dst.header_len && + (sk->sk_type == SOCK_DGRAM)) { err = ip_ufo_append_data(sk, getfrag, from, length, hh_len, fragheaderlen, transhdrlen, mtu, flags); diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 6dff3d7..1934328 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1259,7 +1259,8 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, if (((length > mtu) || (skb && skb_has_frags(skb))) && (sk->sk_protocol == IPPROTO_UDP) && - (rt->u.dst.dev->features & NETIF_F_UFO)) { + (rt->u.dst.dev->features & NETIF_F_UFO) && + (sk->sk_type == SOCK_DGRAM)) { err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len, fragheaderlen, transhdrlen, mtu, flags, rt); -- 1.7.12.2.21.g234cd45.dirty