udp: disable gso with no_check_tx
commita8c744a8b43733509b5625e65fee1985fbb901d7
authorWillem de Bruijn <willemb@google.com>
Mon, 30 Apr 2018 19:58:36 +0000 (30 15:58 -0400)
committerDavid S. Miller <davem@davemloft.net>
Tue, 1 May 2018 18:20:14 +0000 (1 14:20 -0400)
tree718ee5ccc5242b7d269cfe359858441a442337f1
parent05cd271fd61a0bb64fc20c46c9c87b8272fb980c
udp: disable gso with no_check_tx

Syzbot managed to send a udp gso packet without checksum offload into
the gso stack by disabling tx checksum (UDP_NO_CHECK6_TX). This
triggered the skb_warn_bad_offload.

  RIP: 0010:skb_warn_bad_offload+0x2bc/0x600 net/core/dev.c:2658
   skb_gso_segment include/linux/netdevice.h:4038 [inline]
   validate_xmit_skb+0x54d/0xd90 net/core/dev.c:3120
   __dev_queue_xmit+0xbf8/0x34c0 net/core/dev.c:3577
   dev_queue_xmit+0x17/0x20 net/core/dev.c:3618

UDP_NO_CHECK6_TX sets skb->ip_summed to CHECKSUM_NONE just after the
udp gso integrity checks in udp_(v6_)send_skb. Extend those checks to
catch and fail in this case.

After the integrity checks jump directly to the CHECKSUM_PARTIAL case
to avoid reading the no_check_tx flags again (a TOCTTOU race).

Fixes: bec1f6f69736 ("udp: generate gso with UDP_SEGMENT")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/udp.c
net/ipv6/udp.c