• Michal Kubeček's avatar
    udp: only allow UFO for packets from SOCK_DGRAM sockets · 6b313008
    Michal Kubeček authored
    [ Upstream commit acf8dd0a ]
    
    If an over-MTU UDP datagram is sent through a SOCK_RAW socket to a
    UFO-capable device, ip_ufo_append_data() sets skb->ip_summed to
    CHECKSUM_PARTIAL unconditionally as all GSO code assumes transport layer
    checksum is to be computed on segmentation. However, in this case,
    skb->csum_start and skb->csum_offset are never set as raw socket
    transmit path bypasses udp_send_skb() where they are usually set. As a
    result, driver may access invalid memory when trying to calculate the
    checksum and store the result (as observed in virtio_net driver).
    
    Moreover, the very idea of modifying the userspace provided UDP header
    is IMHO against raw socket semantics (I wasn't able to find a document
    clearly stating this or the opposite, though). And while allowing
    CHECKSUM_NONE in the UFO case would be more efficient, it would be a bit
    too intrusive change just to handle a corner case like this. Therefore
    disallowing UFO for packets from SOCK_DGRAM seems to be the best option.
    Signed-off-by: default avatarMichal Kubecek <mkubecek@suse.cz>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    6b313008
ip6_output.c 40.5 KB