udp: prevent skbs lingering in tunnel socket queues

[ Upstream commit e5aed006be918af163eb397e45aa5ea6cefd5e01 ]

In case we find a socket with encapsulation enabled we should call
the encap_recv function even if just a udp header without payload is
available. The callbacks are responsible for correctly verifying and
dropping the packets.

Also, in case the header validation fails for geneve and vxlan we
shouldn't put the skb back into the socket queue, no one will pick
them up there.  Instead we can simply discard them in the respective
encap_recv functions.

Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 7b0a644122ebf064c6058e2aa5bb453cec3d57d1..9fcb4898fb68816a8d5837e65251f8c4eda3e915 100644 (file)
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -336,15 +336,15 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 
        /* Need Geneve and inner Ethernet header to be present */
        if (unlikely(!pskb_may_pull(skb, GENEVE_BASE_HLEN)))
-               goto error;
+               goto drop;
 
        /* Return packets with reserved bits set */
        geneveh = geneve_hdr(skb);
        if (unlikely(geneveh->ver != GENEVE_VER))
-               goto error;
+               goto drop;
 
        if (unlikely(geneveh->proto_type != htons(ETH_P_TEB)))
-               goto error;
+               goto drop;
 
        gs = rcu_dereference_sk_user_data(sk);
        if (!gs)
@@ -367,10 +367,6 @@ drop:
        /* Consume bad packet */
        kfree_skb(skb);
        return 0;
-
-error:
-       /* Let the UDP layer deal with the skb */
-       return 1;
 }
 
 static struct socket *geneve_create_sock(struct net *net, bool ipv6,

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 8ac261ab7d7dd5173afb111850aafe804a3a874d..9aa8678dfaccd6ee93b0a986ab20e9b5715ba4a3 100644 (file)
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1262,7 +1262,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
 
        /* Need Vxlan and inner Ethernet header to be present */
        if (!pskb_may_pull(skb, VXLAN_HLEN))
-               return 1;
+               goto drop;
 
        unparsed = *vxlan_hdr(skb);
        /* VNI flag always required to be set */
@@ -1271,7 +1271,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
                           ntohl(vxlan_hdr(skb)->vx_flags),
                           ntohl(vxlan_hdr(skb)->vx_vni));
                /* Return non vxlan pkt */
-               return 1;
+               goto drop;
        }
        unparsed.vx_flags &= ~VXLAN_HF_VNI;
        unparsed.vx_vni &= ~VXLAN_VNI_MASK;

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index a2e7f55a1f6103e7a84d8ca2dd821841fb51f9bc..e9853dff7b52184bbaaabff87d5f9efdc022c2a0 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1616,7 +1616,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
                /* if we're overly short, let UDP handle it */
                encap_rcv = ACCESS_ONCE(up->encap_rcv);
-               if (skb->len > sizeof(struct udphdr) && encap_rcv) {
+               if (encap_rcv) {
                        int ret;
 
                        /* Verify checksum before giving to encap */

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 6bc5c664fa46c048709db40d1a2a7cc5d4df63da..f96831d9d419d67d56a61dba8b4ffef9c0646662 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -653,7 +653,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
                /* if we're overly short, let UDP handle it */
                encap_rcv = ACCESS_ONCE(up->encap_rcv);
-               if (skb->len > sizeof(struct udphdr) && encap_rcv) {
+               if (encap_rcv) {
                        int ret;
 
                        /* Verify checksum before giving to encap */