udp: prevent skbs lingering in tunnel socket queues

[ Upstream commit e5aed006be918af163eb397e45aa5ea6cefd5e01 ]

In case we find a socket with encapsulation enabled we should call
the encap_recv function even if just a udp header without payload is
available. The callbacks are responsible for correctly verifying and
dropping the packets.

Also, in case the header validation fails for geneve and vxlan we
shouldn't put the skb back into the socket queue, no one will pick
them up there.  Instead we can simply discard them in the respective
encap_recv functions.

Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16:
 - Drop changes to geneve
 - vxlan error checking looked a bit different]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 74dccfa00a5ca340abf3d8cc53bf944f748c890e..7badf2aa3f61e3db7df519cee1237110ed0617ca 100644 (file)
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1146,7 +1146,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 
        /* Need Vxlan and inner Ethernet header to be present */
        if (!pskb_may_pull(skb, VXLAN_HLEN))
-               goto error;
+               goto drop;
 
        /* Return packets with reserved bits set */
        vxh = (struct vxlanhdr *)(udp_hdr(skb) + 1);
@@ -1154,7 +1154,7 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
            (vxh->vx_vni & htonl(0xff))) {
                netdev_dbg(skb->dev, "invalid vxlan flags=%#x vni=%#x\n",
                           ntohl(vxh->vx_flags), ntohl(vxh->vx_vni));
-               goto error;
+               goto drop;
        }
 
        if (iptunnel_pull_header(skb, VXLAN_HLEN, htons(ETH_P_TEB)))
@@ -1173,10 +1173,6 @@ drop:
        /* Consume bad packet */
        kfree_skb(skb);
        return 0;
-
-error:
-       /* Return non vxlan pkt */
-       return 1;
 }
 
 static void vxlan_rcv(struct vxlan_sock *vs,

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 716475fc884b5407226267eb066313d2b3249360..59ddab1fce288ad46ac8002ba95c91b6891422e5 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1533,7 +1533,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
                /* if we're overly short, let UDP handle it */
                encap_rcv = ACCESS_ONCE(up->encap_rcv);
-               if (skb->len > sizeof(struct udphdr) && encap_rcv != NULL) {
+               if (encap_rcv) {
                        int ret;
 
                        /* Verify checksum before giving to encap */

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 8eb38558e157cf535ab19cdb7654a6282db817d6..067011cff207d24fb18150c25709af615143d153 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -631,7 +631,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
                /* if we're overly short, let UDP handle it */
                encap_rcv = ACCESS_ONCE(up->encap_rcv);
-               if (skb->len > sizeof(struct udphdr) && encap_rcv != NULL) {
+               if (encap_rcv) {
                        int ret;
 
                        /* Verify checksum before giving to encap */