Commit 7b5e56f9 authored by Jesper Dangaard Brouer's avatar Jesper Dangaard Brouer Committed by David S. Miller

udp: Fix UDP short packet false positive

The UDP header pointer assignment must happen after calling
pskb_may_pull().  As pskb_may_pull() can potentially alter the SKB
buffer.

This was exposted by running multicast traffic through the NIU driver,
as it won't prepull the protocol headers into the linear area on
receive.
Signed-off-by: default avatarJesper Dangaard Brouer <hawk@comx.dk>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b98ac702
...@@ -1231,7 +1231,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, ...@@ -1231,7 +1231,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
int proto) int proto)
{ {
struct sock *sk; struct sock *sk;
struct udphdr *uh = udp_hdr(skb); struct udphdr *uh;
unsigned short ulen; unsigned short ulen;
struct rtable *rt = (struct rtable*)skb->dst; struct rtable *rt = (struct rtable*)skb->dst;
__be32 saddr = ip_hdr(skb)->saddr; __be32 saddr = ip_hdr(skb)->saddr;
...@@ -1244,6 +1244,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, ...@@ -1244,6 +1244,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
if (!pskb_may_pull(skb, sizeof(struct udphdr))) if (!pskb_may_pull(skb, sizeof(struct udphdr)))
goto drop; /* No space for header. */ goto drop; /* No space for header. */
uh = udp_hdr(skb);
ulen = ntohs(uh->len); ulen = ntohs(uh->len);
if (ulen > skb->len) if (ulen > skb->len)
goto short_packet; goto short_packet;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment