diff mbox series

[5.4,23/88] udp: using datalen to cap max gso segments

Message ID	20211213092934.015054757@linuxfoundation.org
State	New
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Jianguo Wu <wujianguo@chinatelecom.cn>, Willem de Bruijn <willemb@google.com>, Jakub Kicinski <kuba@kernel.org> Subject: [PATCH 5.4 23/88] udp: using datalen to cap max gso segments Date: Mon, 13 Dec 2021 10:29:53 +0100 Message-Id: <20211213092934.015054757@linuxfoundation.org> In-Reply-To: <20211213092933.250314515@linuxfoundation.org> References: <20211213092933.250314515@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,03/88] HID: quirks: Add quirk for the Microsoft Surface 3 type-cover [5.4,05/88] HID: add hid_is_usb() function to make it simpler for USB detection [5.4,09/88] HID: bigbenff: prevent null pointer dereference [5.4,10/88] HID: wacom: fix problems when device is not a valid USB device [5.4,14/88] can: sja1000: fix use after free in ems_pcmcia_add_card() [5.4,16/88] selftests: netfilter: add a vrf+conntrack testcase [5.4,20/88] bonding: make tx_rebalance_counter an atomic [5.4,22/88] seg6: fix the iif in the IPv6 socket control block [5.4,23/88] udp: using datalen to cap max gso segments [5.4,26/88] IB/hfi1: Correct guard on eager buffer deallocation [5.4,28/88] ALSA: ctl: Fix copy of updated id with element read/write [5.4,31/88] ALSA: pcm: oss: Limit the period size to 16MB [5.4,32/88] ALSA: pcm: oss: Handle missing errors in snd_pcm_oss_change_params*() [5.4,34/88] btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling [5.4,35/88] nfsd: Fix nsfd startup race (again) [5.4,37/88] clk: qcom: regmap-mux: fix parent clock lookup [5.4,38/88] drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. [5.4,41/88] x86/sme: Explicitly map new EFI memmap table as encrypted [5.4,42/88] libata: add horkage for ASMedia 1092 [5.4,44/88] binder: use wake_up_pollfree() [5.4,46/88] aio: keep poll requests on waitqueue until completed [5.4,47/88] aio: fix use-after-free due to missing POLLFREE handling [5.4,48/88] tracefs: Set all files to the same group ownership as the mount option [5.4,49/88] block: fix ioprio_get(IOPRIO_WHO_PGRP) vs setuid(2) [5.4,50/88] qede: validate non LSO skb length [5.4,51/88] ASoC: qdsp6: q6routing: Fix return value from msm_routing_put_audio_mixer [5.4,52/88] i40e: Fix failed opcode appearing if handling messages from VF [5.4,53/88] i40e: Fix pre-set max number of queues for VF [5.4,54/88] mtd: rawnand: fsmc: Take instruction delay into account [5.4,55/88] mtd: rawnand: fsmc: Fix timing computation [5.4,56/88] dt-bindings: net: Reintroduce PHY no lane swap binding [5.4,57/88] tools build: Remove needless libpython-version feature check that breaks test-all fas... [5.4,59/88] net: altera: set a couple error code in probe() [5.4,62/88] net/qla3xxx: fix an error code in ql_adapter_up() [5.4,63/88] selftests/fib_tests: Rework fib_rp_filter_test() [5.4,65/88] USB: gadget: zero allocate endpoint 0 buffers [5.4,66/88] usb: core: config: fix validation of wMaxPacketValue entries [5.4,67/88] xhci: Remove CONFIG_USB_DEFAULT_PERSIST to prevent xHCI from runtime suspending [5.4,68/88] usb: core: config: using bit mask instead of individual bits [5.4,70/88] iio: trigger: Fix reference counting [5.4,73/88] iio: mma8452: Fix trigger reference couting [5.4,75/88] iio: kxsd9: Dont return error code in trigger handler [5.4,76/88] iio: itg3200: Call iio_trigger_notify_done() on error [5.4,77/88] iio: dln2-adc: Fix lockdep complaint [5.4,78/88] iio: dln2: Check return value of devm_iio_trigger_register() [5.4,79/88] iio: at91-sama5d2: Fix incorrect sign extension [5.4,80/88] iio: adc: axp20x_adc: fix charging current reporting on AXP22x [5.4,83/88] irqchip/armada-370-xp: Fix return value of armada_370_xp_msi_alloc() [5.4,86/88] irqchip: nvic: Fix offset for Interrupt Priority Offsets

Commit Message

Greg Kroah-Hartman Dec. 13, 2021, 9:29 a.m. UTC

From: Jianguo Wu <wujianguo@chinatelecom.cn>

commit 158390e45612ef0fde160af0826f1740c36daf21 upstream.

The max number of UDP gso segments is intended to cap to UDP_MAX_SEGMENTS,
this is checked in udp_send_skb():

    if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
        kfree_skb(skb);
        return -EINVAL;
    }

skb->len contains network and transport header len here, we should use
only data len instead.

Fixes: bec1f6f69736 ("udp: generate gso with UDP_SEGMENT")
Signed-off-by: Jianguo Wu <wujianguo@chinatelecom.cn>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/900742e5-81fb-30dc-6e0b-375c6cdd7982@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/udp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -845,7 +845,7 @@  static int udp_send_skb(struct sk_buff *
 			kfree_skb(skb);
 			return -EINVAL;
 		}
-		if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
+		if (datalen > cork->gso_size * UDP_MAX_SEGMENTS) {
 			kfree_skb(skb);
 			return -EINVAL;
 		}