udp: prevent skbs lingering in tunnel socket queues

In case we find a socket with encapsulation enabled we should call
the encap_recv function even if just a udp header without payload is
available. The callbacks are responsible for correctly verifying and
dropping the packets.

Also, in case the header validation fails for geneve and vxlan we
shouldn't put the skb back into the socket queue, no one will pick
them up there.  Instead we can simply discard them in the respective
encap_recv functions.

Signed-off-by: Hannes Frederic Sowa <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index a6dc11ce497f5c328581ee3db460eb645e3a8fa5..cadefe4fdaa2aa71cfab4dc8dc0dd4b326f5745b 100644 (file)
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -335,15 +335,15 @@ static int geneve_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
 
        /* Need Geneve and inner Ethernet header to be present */
        if (unlikely(!pskb_may_pull(skb, GENEVE_BASE_HLEN)))
-               goto error;
+               goto drop;
 
        /* Return packets with reserved bits set */
        geneveh = geneve_hdr(skb);
        if (unlikely(geneveh->ver != GENEVE_VER))
-               goto error;
+               goto drop;
 
        if (unlikely(geneveh->proto_type != htons(ETH_P_TEB)))
-               goto error;
+               goto drop;
 
        gs = rcu_dereference_sk_user_data(sk);
        if (!gs)
@@ -366,10 +366,6 @@ drop:
        /* Consume bad packet */
        kfree_skb(skb);
        return 0;
-
-error:
-       /* Let the UDP layer deal with the skb */
-       return 1;
 }
 
 static struct socket *geneve_create_sock(struct net *net, bool ipv6,

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 25ab6bf013c4d2d12aa7619d77628f4793ef6f64..8ff30c3bdfceab5e5aca07bfaeb8635bec96ae0e 100644 (file)
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1304,7 +1304,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
 
        /* Need UDP and VXLAN header to be present */
        if (!pskb_may_pull(skb, VXLAN_HLEN))
-               return 1;
+               goto drop;
 
        unparsed = *vxlan_hdr(skb);
        /* VNI flag always required to be set */
@@ -1313,7 +1313,7 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
                           ntohl(vxlan_hdr(skb)->vx_flags),
                           ntohl(vxlan_hdr(skb)->vx_vni));
                /* Return non vxlan pkt */
-               return 1;
+               goto drop;
        }
        unparsed.vx_flags &= ~VXLAN_HF_VNI;
        unparsed.vx_vni &= ~VXLAN_VNI_MASK;

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 2e3ebfe5549ef5dd5a18311b0b5c571aa418d19b..d56c0559b477cb96ce78c9b9b7dacc3109594f3a 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1565,7 +1565,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
                /* if we're overly short, let UDP handle it */
                encap_rcv = ACCESS_ONCE(up->encap_rcv);
-               if (skb->len > sizeof(struct udphdr) && encap_rcv) {
+               if (encap_rcv) {
                        int ret;
 
                        /* Verify checksum before giving to encap */

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 2ba6a77a8815325e944be71bd3c8eb24d487260e..2da1896af93496cc58762c67b4cd4b4f42924901 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -617,7 +617,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
                /* if we're overly short, let UDP handle it */
                encap_rcv = ACCESS_ONCE(up->encap_rcv);
-               if (skb->len > sizeof(struct udphdr) && encap_rcv) {
+               if (encap_rcv) {
                        int ret;
 
                        /* Verify checksum before giving to encap */