Commit bbcf467d authored by Herbert Xu's avatar Herbert Xu Committed by David S. Miller
Browse files

[NET]: Verify gso_type too in gso_segment 



We don't want nasty Xen guests to pass a TCPv6 packet in with gso_type set
to TCPv4 or even UDP (or a packet that's both TCP and UDP).

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6ce1669f

net/ipv4/af_inet.c

+11 −3
Original line number Diff line number Diff line
@@ -1106,7 +1106,15 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features) 
	int ihl;

	int id;



	if (!pskb_may_pull(skb, sizeof(*iph)))

	if (unlikely(skb_shinfo(skb)->gso_type &

		     ~(SKB_GSO_TCPV4 |

		       SKB_GSO_UDP |

		       SKB_GSO_DODGY |

		       SKB_GSO_TCP_ECN |

		       0)))

		goto out;



	if (unlikely(!pskb_may_pull(skb, sizeof(*iph))))

		goto out;



	iph = skb->nh.iph;
@@ -1114,7 +1122,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features) 
	if (ihl < sizeof(*iph))

		goto out;



	if (!pskb_may_pull(skb, ihl))

	if (unlikely(!pskb_may_pull(skb, ihl)))

		goto out;



	skb->h.raw = __skb_pull(skb, ihl);
@@ -1125,7 +1133,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features) 


	rcu_read_lock();

	ops = rcu_dereference(inet_protos[proto]);

	if (ops && ops->gso_segment)

	if (likely(ops && ops->gso_segment))

		segs = ops->gso_segment(skb, features);

	rcu_read_unlock();

net/ipv4/tcp.c

+12 −1
Original line number Diff line number Diff line
@@ -2170,8 +2170,19 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features) 


	if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST)) {

		/* Packet is from an untrusted source, reset gso_segs. */

		int mss = skb_shinfo(skb)->gso_size;

		int type = skb_shinfo(skb)->gso_type;

		int mss;



		if (unlikely(type &

			     ~(SKB_GSO_TCPV4 |

			       SKB_GSO_DODGY |

			       SKB_GSO_TCP_ECN |

			       SKB_GSO_TCPV6 |

			       0) ||

			     !(type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))))

			goto out;



		mss = skb_shinfo(skb)->gso_size;

		skb_shinfo(skb)->gso_segs = (skb->len + mss - 1) / mss;



		segs = NULL;

net/ipv6/ipv6_sockglue.c

+8 −0
Original line number Diff line number Diff line
@@ -64,6 +64,14 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features) 
	struct inet6_protocol *ops;

	int proto;



	if (unlikely(skb_shinfo(skb)->gso_type &

		     ~(SKB_GSO_UDP |

		       SKB_GSO_DODGY |

		       SKB_GSO_TCP_ECN |

		       SKB_GSO_TCPV6 |

		       0)))

		goto out;



	if (unlikely(!pskb_may_pull(skb, sizeof(*ipv6h))))

		goto out;