Commit acf8dd0a authored Mar 02, 2015 by Michal Kubeček Committed by David S. Miller Mar 02, 2015

udp: only allow UFO for packets from SOCK_DGRAM sockets

If an over-MTU UDP datagram is sent through a SOCK_RAW socket to a
UFO-capable device, ip_ufo_append_data() sets skb->ip_summed to
CHECKSUM_PARTIAL unconditionally as all GSO code assumes transport layer
checksum is to be computed on segmentation. However, in this case,
skb->csum_start and skb->csum_offset are never set as raw socket
transmit path bypasses udp_send_skb() where they are usually set. As a
result, driver may access invalid memory when trying to calculate the
checksum and store the result (as observed in virtio_net driver).

Moreover, the very idea of modifying the userspace provided UDP header
is IMHO against raw socket semantics (I wasn't able to find a document
clearly stating this or the opposite, though). And while allowing
CHECKSUM_NONE in the UFO case would be more efficient, it would be a bit
too intrusive change just to handle a corner case like this. Therefore
disallowing UFO for packets from SOCK_DGRAM seems to be the best option.

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 096b1c17

net/ipv4/ip_output.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -888,7 +888,8 @@ static int __ip_append_data(struct sock *sk,
		cork->length += length;
		if (((length > mtu) \|\| (skb && skb_is_gso(skb))) &&
		(sk->sk_protocol == IPPROTO_UDP) &&
		(rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
		(rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
		(sk->sk_type == SOCK_DGRAM)) {
		err = ip_ufo_append_data(sk, queue, getfrag, from, length,
		hh_len, fragheaderlen, transhdrlen,
		maxfraglen, flags);

net/ipv6/ip6_output.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1298,7 +1298,8 @@ static int __ip6_append_data(struct sock *sk,
		if (((length > mtu) \|\|
		(skb && skb_is_gso(skb))) &&
		(sk->sk_protocol == IPPROTO_UDP) &&
		(rt->dst.dev->features & NETIF_F_UFO)) {
		(rt->dst.dev->features & NETIF_F_UFO) &&
		(sk->sk_type == SOCK_DGRAM)) {
		err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
		hh_len, fragheaderlen,
		transhdrlen, mtu, flags, rt);