]> git.baikalelectronics.ru Git - kernel.git/commit
fou6: Prevent unbounded recursion in GUE error handler
authorStefano Brivio <sbrivio@redhat.com>
Thu, 3 Jan 2019 20:43:35 +0000 (21:43 +0100)
committerDavid S. Miller <davem@davemloft.net>
Fri, 4 Jan 2019 21:06:07 +0000 (13:06 -0800)
commit304fbbffc1cef4241b10bc24e0ad48ffb1a23349
tree2b47c88227cbd7d560fb44002cf62b896d8631fd
parent3bdecaf4aff6c53b7b6dade2d87635f9ad17ab83
fou6: Prevent unbounded recursion in GUE error handler

I forgot to deal with IPv6 in commit 6305f06f1bde ("fou: Prevent unbounded
recursion in GUE error handler").

Now syzbot reported what might be the same type of issue, caused by
gue6_err(), that is, handling exceptions for direct UDP encapsulation in
GUE (UDP-in-UDP) leads to unbounded recursion in the GUE exception
handler.

As it probably doesn't make sense to set up GUE this way, and it's
currently not even possible to configure this, skip exception handling for
UDP (or UDP-Lite) packets encapsulated in UDP (or UDP-Lite) packets with
GUE on IPv6.

Reported-by: syzbot+4ad25edc7a33e4ab91e0@syzkaller.appspotmail.com
Reported-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Fixes: a56ddf3374c2 ("fou, fou6: ICMP error handlers for FoU and GUE")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/fou6.c