Skip to content

Commit

Permalink
udp: use sk_filter_trim_cap for udp{,6}_queue_rcv_skb
Browse files Browse the repository at this point in the history
After a612769 ("udp: prevent bugcheck if filter truncates packet
too much"), there followed various other fixes for similar cases such
as f4979fc ("rose: limit sk_filter trim to payload").

Latter introduced a new helper sk_filter_trim_cap(), where we can pass
the trim limit directly to the socket filter handling. Make use of it
here as well with sizeof(struct udphdr) as lower cap limit and drop the
extra skb->len test in UDP's input path.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Daniel Borkmann authored and David S. Miller committed Jul 26, 2016
1 parent deb1f45 commit ba66bbe
Show file tree
Hide file tree
Showing 2 changed files with 2 additions and 6 deletions.
4 changes: 1 addition & 3 deletions net/ipv4/udp.c
Original file line number Diff line number Diff line change
Expand Up @@ -1581,9 +1581,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
udp_lib_checksum_complete(skb))
goto csum_error;

if (sk_filter(sk, skb))
goto drop;
if (unlikely(skb->len < sizeof(struct udphdr)))
if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
goto drop;

udp_csum_pull_header(skb);
Expand Down
4 changes: 1 addition & 3 deletions net/ipv6/udp.c
Original file line number Diff line number Diff line change
Expand Up @@ -618,9 +618,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
udp_lib_checksum_complete(skb))
goto csum_error;

if (sk_filter(sk, skb))
goto drop;
if (unlikely(skb->len < sizeof(struct udphdr)))
if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
goto drop;

udp_csum_pull_header(skb);
Expand Down

0 comments on commit ba66bbe

Please sign in to comment.