diff options
| author | Willem de Bruijn <willemb@google.com> | 2019-02-19 05:37:12 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-02-21 23:08:13 +0100 |
| commit | 9e8db5913264d3967b93c765a6a9e464d9c473db (patch) | |
| tree | 4b85aa0a1cace6820ddfd86504c4e6550378c8a0 /net/ipv4/ip_gre.c | |
| parent | Merge branch 'tipc-improvement-for-wait-and-wakeup' (diff) | |
| download | linux-9e8db5913264d3967b93c765a6a9e464d9c473db.tar.xz linux-9e8db5913264d3967b93c765a6a9e464d9c473db.zip | |
net: avoid false positives in untrusted gso validation
GSO packets with vnet_hdr must conform to a small set of gso_types.
The below commit uses flow dissection to drop packets that do not.
But it has false positives when the skb is not fully initialized.
Dissection needs skb->protocol and skb->network_header.
Infer skb->protocol from gso_type as the two must agree.
SKB_GSO_UDP can use both ipv4 and ipv6, so try both.
Exclude callers for which network header offset is not known.
Fixes: d5be7f632bad ("net: validate untrusted gso packets without csum offload")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/ipv4/ip_gre.c')
0 files changed, 0 insertions, 0 deletions