netdev - Re: [PATCH net-next 14/17] udp: Validate UDP length in udp_gro

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cab41522-7f92-4354-984e-2eddaf921698@redhat.com>
Date: Thu, 25 Sep 2025 16:10:05 +0200
From: Paolo Abeni <pabeni@...hat.com>
To: Maxim Mikityanskiy <maxtram95@...il.com>,
 Daniel Borkmann <daniel@...earbox.net>, "David S. Miller"
 <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>,
 Willem de Bruijn <willemdebruijn.kernel@...il.com>,
 David Ahern <dsahern@...nel.org>, Nikolay Aleksandrov <razor@...ckwall.org>
Cc: netdev@...r.kernel.org, tcpdump-workers@...ts.tcpdump.org,
 Guy Harris <gharris@...ic.net>, Michael Richardson <mcr@...delman.ca>,
 Denis Ovsienko <denis@...ienko.info>, Xin Long <lucien.xin@...il.com>,
 Maxim Mikityanskiy <maxim@...valent.com>
Subject: Re: [PATCH net-next 14/17] udp: Validate UDP length in
 udp_gro_receive

On 9/23/25 3:47 PM, Maxim Mikityanskiy wrote:
> From: Maxim Mikityanskiy <maxim@...valent.com>
> 
> From: Maxim Mikityanskiy <maxim@...valent.com>
> 
> In the previous commit we started using uh->len = 0 as a marker of a GRO
> packet bigger than 65536 bytes. To prevent abuse by maliciously crafted
> packets, check the length in the UDP header in udp_gro_receive. Note
> that a similar check is present in udp_gro_receive_segment, but not in
> the UDP socket gro_receive flow.
> 
> Signed-off-by: Maxim Mikityanskiy <maxim@...valent.com>
> ---
>  net/ipv4/udp_offload.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
> index 1e7ed7718d7b..fd86f76fda2c 100644
> --- a/net/ipv4/udp_offload.c
> +++ b/net/ipv4/udp_offload.c
> @@ -788,6 +788,7 @@ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
>  	struct sk_buff *p;
>  	struct udphdr *uh2;
>  	unsigned int off = skb_gro_offset(skb);
> +	unsigned int ulen;
>  	int flush = 1;
>  
>  	/* We can do L4 aggregation only if the packet can't land in a tunnel
> @@ -820,6 +821,10 @@ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
>  	     !NAPI_GRO_CB(skb)->csum_valid))
>  		goto out;
>  
> +	ulen = ntohs(uh->len);
> +	if (ulen <= sizeof(*uh) || ulen != skb_gro_len(skb))
> +		goto out;

Possibly consolidate both checks in single, earlier one?

/P