From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexander Duyck Subject: [net-next PATCH v2 2/8] udp: Verify that pulling UDP header in GSO segmentation doesn't fail Date: Fri, 04 May 2018 11:29:35 -0700 Message-ID: <20180504182857.5194.45504.stgit@localhost.localdomain> References: <20180504182537.5194.72775.stgit@localhost.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit To: netdev@vger.kernel.org, willemb@google.com, davem@davemloft.net Return-path: Received: from mail-pg0-f65.google.com ([74.125.83.65]:43996 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751507AbeEDS3h (ORCPT ); Fri, 4 May 2018 14:29:37 -0400 Received: by mail-pg0-f65.google.com with SMTP id k11-v6so14854982pgo.10 for ; Fri, 04 May 2018 11:29:36 -0700 (PDT) In-Reply-To: <20180504182537.5194.72775.stgit@localhost.localdomain> Sender: netdev-owner@vger.kernel.org List-ID: From: Alexander Duyck We should verify that we can pull the UDP header before we attempt to do so. Otherwise if this fails we have no way of knowing and GSO will not work correctly. Signed-off-by: Alexander Duyck --- v2: New break-out patch based on one patch from earlier series net/ipv4/udp_offload.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index 006257092f06..8303fff42940 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -191,14 +191,17 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, netdev_features_t features, unsigned int mss, __sum16 check) { + struct sk_buff *seg, *segs = ERR_PTR(-EINVAL); struct sock *sk = gso_skb->sk; unsigned int sum_truesize = 0; - struct sk_buff *segs, *seg; unsigned int hdrlen; struct udphdr *uh; if (gso_skb->len <= sizeof(*uh) + mss) - return ERR_PTR(-EINVAL); + goto out; + + if (!pskb_may_pull(gso_skb, sizeof(*uh))) + goto out; hdrlen = gso_skb->data - skb_mac_header(gso_skb); skb_pull(gso_skb, sizeof(*uh)); @@ -230,7 +233,7 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, } refcount_add(sum_truesize - gso_skb->truesize, &sk->sk_wmem_alloc); - +out: return segs; } EXPORT_SYMBOL_GPL(__udp_gso_segment);