udp: use sk_filter_trim_cap for udp{,6}_queue_rcv_skb

[ Upstream commit ba66bbe5480a012108958a71cff88b23dce84956 ]

After a612769774a3 ("udp: prevent bugcheck if filter truncates packet
too much"), there followed various other fixes for similar cases such
as f4979fcea7fd ("rose: limit sk_filter trim to payload").

Latter introduced a new helper sk_filter_trim_cap(), where we can pass
the trim limit directly to the socket filter handling. Make use of it
here as well with sizeof(struct udphdr) as lower cap limit and drop the
extra skb->len test in UDP's input path.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Willem de Bruijn <willemb@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4aed8fc23d328592f8cf267fca70582f62fc6a3e..e61f7cd65d08a478f4b4f4d60841688b89bb1f2d 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1581,9 +1581,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
            udp_lib_checksum_complete(skb))
                        goto csum_error;
 
-       if (sk_filter(sk, skb))
-               goto drop;
-       if (unlikely(skb->len < sizeof(struct udphdr)))
+       if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
                goto drop;
 
        udp_csum_pull_header(skb);

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index acc09705618b4cccd622122f58ce4ab1639f22d1..42a2edf7c9efcc1d8b1ec0eea7d49e4a35b57a38 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -618,9 +618,7 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
            udp_lib_checksum_complete(skb))
                goto csum_error;
 
-       if (sk_filter(sk, skb))
-               goto drop;
-       if (unlikely(skb->len < sizeof(struct udphdr)))
+       if (sk_filter_trim_cap(sk, skb, sizeof(struct udphdr)))
                goto drop;
 
        udp_csum_pull_header(skb);