Commit a8c744a8 authored by Willem de Bruijn's avatar Willem de Bruijn Committed by David S. Miller

udp: disable gso with no_check_tx

Syzbot managed to send a udp gso packet without checksum offload into
the gso stack by disabling tx checksum (UDP_NO_CHECK6_TX). This
triggered the skb_warn_bad_offload.

  RIP: 0010:skb_warn_bad_offload+0x2bc/0x600 net/core/dev.c:2658
   skb_gso_segment include/linux/netdevice.h:4038 [inline]
   validate_xmit_skb+0x54d/0xd90 net/core/dev.c:3120
   __dev_queue_xmit+0xbf8/0x34c0 net/core/dev.c:3577
   dev_queue_xmit+0x17/0x20 net/core/dev.c:3618

UDP_NO_CHECK6_TX sets skb->ip_summed to CHECKSUM_NONE just after the
udp gso integrity checks in udp_(v6_)send_skb. Extend those checks to
catch and fail in this case.

After the integrity checks jump directly to the CHECKSUM_PARTIAL case
to avoid reading the no_check_tx flags again (a TOCTTOU race).

Fixes: bec1f6f6 ("udp: generate gso with UDP_SEGMENT")
Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 05cd271f
...@@ -786,11 +786,14 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4, ...@@ -786,11 +786,14 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
return -EINVAL; return -EINVAL;
if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
return -EINVAL; return -EINVAL;
if (sk->sk_no_check_tx)
return -EINVAL;
if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite) if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite)
return -EIO; return -EIO;
skb_shinfo(skb)->gso_size = cork->gso_size; skb_shinfo(skb)->gso_size = cork->gso_size;
skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4; skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
goto csum_partial;
} }
if (is_udplite) /* UDP-Lite */ if (is_udplite) /* UDP-Lite */
...@@ -802,6 +805,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4, ...@@ -802,6 +805,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
goto send; goto send;
} else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */ } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
csum_partial:
udp4_hwcsum(skb, fl4->saddr, fl4->daddr); udp4_hwcsum(skb, fl4->saddr, fl4->daddr);
goto send; goto send;
......
...@@ -1051,11 +1051,14 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6, ...@@ -1051,11 +1051,14 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
return -EINVAL; return -EINVAL;
if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
return -EINVAL; return -EINVAL;
if (udp_sk(sk)->no_check6_tx)
return -EINVAL;
if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite) if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite)
return -EIO; return -EIO;
skb_shinfo(skb)->gso_size = cork->gso_size; skb_shinfo(skb)->gso_size = cork->gso_size;
skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4; skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
goto csum_partial;
} }
if (is_udplite) if (is_udplite)
...@@ -1064,6 +1067,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6, ...@@ -1064,6 +1067,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
skb->ip_summed = CHECKSUM_NONE; skb->ip_summed = CHECKSUM_NONE;
goto send; goto send;
} else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */ } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
csum_partial:
udp6_hwcsum_outgoing(sk, skb, &fl6->saddr, &fl6->daddr, len); udp6_hwcsum_outgoing(sk, skb, &fl6->saddr, &fl6->daddr, len);
goto send; goto send;
} else } else
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment