Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7821b24a authored by Jason A. Donenfeld's avatar Jason A. Donenfeld Committed by Lee Jones
Browse files

UPSTREAM: wireguard: device: do not generate ICMP for non-IP packets 



If skb->protocol doesn't match the actual skb->data header, it's
probably not a good idea to pass it off to icmp{,v6}_ndo_send, which is
expecting to reply to a valid IP packet. So this commit has that early
mismatch case jump to a later error label.

Bug: 254441685
Fixes: e7096c131e51 ("net: WireGuard secure network tunnel")
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
(cherry picked from commit 99fff5264e7ab06f45b0ad60243475be0a8d0559)
Signed-off-by: default avatarLee Jones <joneslee@google.com>
Change-Id: Id4ecf76fbe0b144ad5157be15ff085d499eb8102
parent 289c814f

drivers/net/wireguard/device.c

+4 −3
Original line number Diff line number Diff line
@@ -138,7 +138,7 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) 
		else if (skb->protocol == htons(ETH_P_IPV6))

			net_dbg_ratelimited("%s: No peer has allowed IPs matching %pI6\n",

					    dev->name, &ipv6_hdr(skb)->daddr);

		goto err;

		goto err_icmp;

	}



	family = READ_ONCE(peer->endpoint.addr.sa_family);
@@ -201,12 +201,13 @@ static netdev_tx_t wg_xmit(struct sk_buff *skb, struct net_device *dev) 


err_peer:

	wg_peer_put(peer);

err:

	++dev->stats.tx_errors;

err_icmp:

	if (skb->protocol == htons(ETH_P_IP))

		icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);

	else if (skb->protocol == htons(ETH_P_IPV6))

		icmpv6_ndo_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);

err:

	++dev->stats.tx_errors;

	kfree_skb(skb);

	return ret;

}