udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments
authorXin Long <lucien.xin@gmail.com>
Mon, 7 Dec 2020 07:55:40 +0000 (15:55 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 21 Dec 2020 12:28:15 +0000 (13:28 +0100)
commit41097c9c282156ca6fe5d514d2b20913648c988e
tree92950020db64a8f0574dc9ba947077633f5d62eb
parent8253de6c16ec05c44f1eed6b01ce1b901aee9dfb
udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments

[ Upstream commit 10c678bd0a035ac2c64a9b26b222f20556227a53 ]

Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the
proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu().
Otherwize, with a negtive value passed, it will underflow inet_protos.

This can be reproduced with IPIP FOU:

  # ip fou add port 5555 ipproto 4
  # ethtool -K eth1 rx-gro-list on

Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection")
Reported-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/ipv4/udp.c