소스 검색

udp: use sk_filter_trim_cap for udp{,6}_queue_rcv_skb

After a612769774a3 ("udp: prevent bugcheck if filter truncates packet
too much"), there followed various other fixes for similar cases such
as f4979fcea7fd ("rose: limit sk_filter trim to payload").

Latter introduced a new helper sk_filter_trim_cap(), where we can pass
the trim limit directly to the socket filter handling. Make use of it
here as well with sizeof(struct udphdr) as lower cap limit and drop the
extra skb->len test in UDP's input path.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Daniel Borkmann 9 년 전
부모
커밋
ba66bbe548
2개의 변경된 파일2개의 추가작업 그리고 6개의 파일을 삭제
  1. 1 3
      net/ipv4/udp.c
  2. 1 3
      net/ipv6/udp.c

+ 1 - 3
net/ipv4/udp.c

@@ -1581,9 +1581,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 	    udp_lib_checksum_complete(skb))
 	    udp_lib_checksum_complete(skb))
 			goto csum_error;
 			goto csum_error;
 
 
-	if (sk_filter(sk, skb))
-		goto drop;
-	if (unlikely(skb->len < sizeof(struct udphdr)))
+	if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
 		goto drop;
 		goto drop;
 
 
 	udp_csum_pull_header(skb);
 	udp_csum_pull_header(skb);

+ 1 - 3
net/ipv6/udp.c

@@ -618,9 +618,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 	    udp_lib_checksum_complete(skb))
 	    udp_lib_checksum_complete(skb))
 		goto csum_error;
 		goto csum_error;
 
 
-	if (sk_filter(sk, skb))
-		goto drop;
-	if (unlikely(skb->len < sizeof(struct udphdr)))
+	if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
 		goto drop;
 		goto drop;
 
 
 	udp_csum_pull_header(skb);
 	udp_csum_pull_header(skb);