Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 33dc6a6a authored by Willem de Bruijn's avatar Willem de Bruijn Committed by Greg Kroah-Hartman
Browse files

udp: consistently apply ufo or fragmentation 




[ Upstream commit 85f1bd9a7b5a79d5baa8bf44af19658f7bf77bfa ]

When iteratively building a UDP datagram with MSG_MORE and that
datagram exceeds MTU, consistently choose UFO or fragmentation.

Once skb_is_gso, always apply ufo. Conversely, once a datagram is
split across multiple skbs, do not consider ufo.

Sendpage already maintains the first invariant, only add the second.
IPv6 does not have a sendpage implementation to modify.

A gso skb must have a partial checksum, do not follow sk_no_check_tx
in udp_send_skb.

Found by syzkaller.

Fixes: e89e9cf5 ("[IPv4/IPv6]: UFO Scatter-gather approach")
Reported-by: default avatarAndrey Konovalov <andreyknvl@google.com>
Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4688f042

net/ipv4/ip_output.c

+5 −2
Original line number Diff line number Diff line
@@ -936,10 +936,12 @@ static int __ip_append_data(struct sock *sk, 
		csummode = CHECKSUM_PARTIAL;



	cork->length += length;

	if (((length > mtu) || (skb && skb_is_gso(skb))) &&

	if ((skb && skb_is_gso(skb)) ||

	    ((length > mtu) &&

	    (skb_queue_len(queue) <= 1) &&

	    (sk->sk_protocol == IPPROTO_UDP) &&

	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&

	    (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {

	    (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {

		err = ip_ufo_append_data(sk, queue, getfrag, from, length,

					 hh_len, fragheaderlen, transhdrlen,

					 maxfraglen, flags);
@@ -1255,6 +1257,7 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page, 
		return -EINVAL;



	if ((size + skb->len > mtu) &&

	    (skb_queue_len(&sk->sk_write_queue) == 1) &&

	    (sk->sk_protocol == IPPROTO_UDP) &&

	    (rt->dst.dev->features & NETIF_F_UFO)) {

		if (skb->ip_summed != CHECKSUM_PARTIAL)

net/ipv4/udp.c

+1 −1
Original line number Diff line number Diff line
@@ -813,7 +813,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4) 
	if (is_udplite)  				 /*     UDP-Lite      */

		csum = udplite_csum(skb);



	else if (sk->sk_no_check_tx) {   /* UDP csum disabled */

	else if (sk->sk_no_check_tx && !skb_is_gso(skb)) {   /* UDP csum off */



		skb->ip_summed = CHECKSUM_NONE;

		goto send;

net/ipv6/ip6_output.c

+4 −3
Original line number Diff line number Diff line
@@ -1372,11 +1372,12 @@ static int __ip6_append_data(struct sock *sk, 
	 */



	cork->length += length;

	if ((((length + fragheaderlen) > mtu) ||

	     (skb && skb_is_gso(skb))) &&

	if ((skb && skb_is_gso(skb)) ||

	    (((length + fragheaderlen) > mtu) &&

	    (skb_queue_len(queue) <= 1) &&

	    (sk->sk_protocol == IPPROTO_UDP) &&

	    (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&

	    (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {

	    (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {

		err = ip6_ufo_append_data(sk, queue, getfrag, from, length,

					  hh_len, fragheaderlen, exthdrlen,

					  transhdrlen, mtu, flags, fl6);