From patchwork Thu Feb 5 12:47:07 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jesper Dangaard Brouer X-Patchwork-Id: 22109 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 19A91DDDF3 for ; Thu, 5 Feb 2009 23:47:17 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754040AbZBEMrL (ORCPT ); Thu, 5 Feb 2009 07:47:11 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753777AbZBEMrK (ORCPT ); Thu, 5 Feb 2009 07:47:10 -0500 Received: from lanfw001a.cxnet.dk ([87.72.215.196]:58692 "EHLO lanfw001a.cxnet.dk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752674AbZBEMrJ (ORCPT ); Thu, 5 Feb 2009 07:47:09 -0500 Received: from comxexch02.comx.local (unknown [172.31.1.117]) by lanfw001a.cxnet.dk (Postfix) with ESMTP id E2DB7163832; Thu, 5 Feb 2009 13:47:07 +0100 (CET) Received: from 172.31.4.93 ([172.31.4.93]) by comxexch02.comx.local ([172.31.1.117]) with Microsoft Exchange Server HTTP-DAV ; Thu, 5 Feb 2009 12:47:07 +0000 Received: from hawk by comxexch02.comx.local; 05 Feb 2009 13:47:07 +0100 Subject: [PATCH] Fix UDP short packet false positive From: Jesper Dangaard Brouer Reply-To: jdb@comx.dk To: David Miller Cc: netdev@vger.kernel.org In-Reply-To: <1233837840.20497.129.camel@localhost.localdomain> References: <1233668300.20497.49.camel@localhost.localdomain> <20090203.153853.163818774.davem@davemloft.net> <1233737704.20497.70.camel@localhost.localdomain> <20090204.010029.12969718.davem@davemloft.net> <1233837840.20497.129.camel@localhost.localdomain> Organization: ComX Networks A/S Date: Thu, 05 Feb 2009 13:47:07 +0100 Message-Id: <1233838027.20497.132.camel@localhost.localdomain> Mime-Version: 1.0 X-Mailer: Evolution 2.6.3 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The UDP header pointer assignment must happen after calling pskb_may_pull(). As pskb_may_pull() can potentially alter the SKB buffer. This was exposted by running multicast traffic through the NIU driver, as it won't prepull the protocol headers into the linear area on receive. Signed-off-by: Jesper Dangaard Brouer --- net/ipv4/udp.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 1ab180b..cc3a0a0 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1231,7 +1231,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, int proto) { struct sock *sk; - struct udphdr *uh = udp_hdr(skb); + struct udphdr *uh; unsigned short ulen; struct rtable *rt = (struct rtable*)skb->dst; __be32 saddr = ip_hdr(skb)->saddr; @@ -1244,6 +1244,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, if (!pskb_may_pull(skb, sizeof(struct udphdr))) goto drop; /* No space for header. */ + uh = udp_hdr(skb); ulen = ntohs(uh->len); if (ulen > skb->len) goto short_packet;