]> git.baikalelectronics.ru Git - kernel.git/commit
fou: Prevent unbounded recursion in GUE error handler
authorStefano Brivio <sbrivio@redhat.com>
Mon, 17 Dec 2018 23:13:17 +0000 (00:13 +0100)
committerDavid S. Miller <davem@davemloft.net>
Tue, 18 Dec 2018 05:38:04 +0000 (21:38 -0800)
commit9552a5f13a10c2aca856955043336bf5cbd69b9f
tree68004178117f344d16b990edf36e7a18367aa24f
parent8a4901cf44338d4a0bbd17be345d3e54d58e189b
fou: Prevent unbounded recursion in GUE error handler

Handling exceptions for direct UDP encapsulation in GUE (that is,
UDP-in-UDP) leads to unbounded recursion in the GUE exception handler,
syzbot reported.

While draft-ietf-intarea-gue-06 doesn't explicitly forbid direct
encapsulation of UDP in GUE, it probably doesn't make sense to set up GUE
this way, and it's currently not even possible to configure this.

Skip exception handling if the GUE proto/ctype field is set to the UDP
protocol number. Should we need to handle exceptions for UDP-in-GUE one
day, we might need to either explicitly set a bound for recursion, or
implement a special iterative handling for these cases.

Reported-and-tested-by: syzbot+43f6755d1c2e62743468@syzkaller.appspotmail.com
Fixes: ee617721beaf ("fou, fou6: ICMP error handlers for FoU and GUE")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/fou.c