• Willem de Bruijn's avatar
    dccp: limit sk_filter trim to payload · 4f0c40d9
    Willem de Bruijn authored
    Dccp verifies packet integrity, including length, at initial rcv in
    dccp_invalid_packet, later pulls headers in dccp_enqueue_skb.
    
    A call to sk_filter in-between can cause __skb_pull to wrap skb->len.
    skb_copy_datagram_msg interprets this as a negative value, so
    (correctly) fails with EFAULT. The negative length is reported in
    ioctl SIOCINQ or possibly in a DCCP_WARN in dccp_close.
    
    Introduce an sk_receive_skb variant that caps how small a filter
    program can trim packets, and call this in dccp with the header
    length. Excessively trimmed packets are now processed normally and
    queued for reception as 0B payloads.
    
    Fixes: 7c657876 ("[DCCP]: Initial implementation")
    Signed-off-by: default avatarWillem de Bruijn <willemb@google.com>
    Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    4f0c40d9
ipv6.c 29.1 KB