Skip to content

Commit

Permalink
fou6: Prevent unbounded recursion in GUE error handler
Browse files Browse the repository at this point in the history
I forgot to deal with IPv6 in commit 1178903 ("fou: Prevent unbounded
recursion in GUE error handler").

Now syzbot reported what might be the same type of issue, caused by
gue6_err(), that is, handling exceptions for direct UDP encapsulation in
GUE (UDP-in-UDP) leads to unbounded recursion in the GUE exception
handler.

As it probably doesn't make sense to set up GUE this way, and it's
currently not even possible to configure this, skip exception handling for
UDP (or UDP-Lite) packets encapsulated in UDP (or UDP-Lite) packets with
GUE on IPv6.

Reported-by: [email protected]
Reported-by: Willem de Bruijn <[email protected]>
Reported-by: Eric Dumazet <[email protected]>
Fixes: b8a51b3 ("fou, fou6: ICMP error handlers for FoU and GUE")
Signed-off-by: Stefano Brivio <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
  • Loading branch information
sbrivio-rh authored and davem330 committed Jan 4, 2019
1 parent bc6e019 commit 44039e0
Showing 1 changed file with 8 additions and 0 deletions.
8 changes: 8 additions & 0 deletions net/ipv6/fou6.c
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,14 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
if (validate_gue_flags(guehdr, optlen))
return -EINVAL;

/* Handling exceptions for direct UDP encapsulation in GUE would lead to
* recursion. Besides, this kind of encapsulation can't even be
* configured currently. Discard this.
*/
if (guehdr->proto_ctype == IPPROTO_UDP ||
guehdr->proto_ctype == IPPROTO_UDPLITE)
return -EOPNOTSUPP;

skb_set_transport_header(skb, -(int)sizeof(struct icmp6hdr));
ret = gue6_err_proto_handler(guehdr->proto_ctype, skb,
opt, type, code, offset, info);
Expand Down

0 comments on commit 44039e0

Please sign in to comment.