diff options
author | Willem de Bruijn <willemb@google.com> | 2019-02-18 23:37:12 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2019-02-21 14:08:13 -0800 |
commit | 9e8db5913264d3967b93c765a6a9e464d9c473db (patch) | |
tree | 4b85aa0a1cace6820ddfd86504c4e6550378c8a0 /net/psample | |
parent | 06cd1702eeb0a79de03f3088ccf4c65f6dfeeaf5 (diff) | |
download | linux-9e8db5913264d3967b93c765a6a9e464d9c473db.tar.gz |
net: avoid false positives in untrusted gso validation
GSO packets with vnet_hdr must conform to a small set of gso_types. The below commit uses flow dissection to drop packets that do not. But it has false positives when the skb is not fully initialized. Dissection needs skb->protocol and skb->network_header. Infer skb->protocol from gso_type as the two must agree. SKB_GSO_UDP can use both ipv4 and ipv6, so try both. Exclude callers for which network header offset is not known. Fixes: d5be7f632bad ("net: validate untrusted gso packets without csum offload") Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/psample')
0 files changed, 0 insertions, 0 deletions