Commit 10c678bd authored by Xin Long's avatar Xin Long Committed by David S. Miller
Browse files

udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments 



Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the
proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu().
Otherwize, with a negtive value passed, it will underflow inet_protos.

This can be reproduced with IPIP FOU:

  # ip fou add port 5555 ipproto 4
  # ethtool -K eth1 rx-gro-list on

Fixes: cf329aa4 ("udp: cope with UDP GRO packet misdirection")
Reported-by: default avatarGuillaume Nault <gnault@redhat.com>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 61f54de2

net/ipv4/udp.c

+1 −1
Original line number Diff line number Diff line
@@ -2173,7 +2173,7 @@ static int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb) 
		__skb_pull(skb, skb_transport_offset(skb));

		ret = udp_queue_rcv_one_skb(sk, skb);

		if (ret > 0)

			ip_protocol_deliver_rcu(dev_net(skb->dev), skb, -ret);

			ip_protocol_deliver_rcu(dev_net(skb->dev), skb, ret);

	}

	return 0;

}