From: Willem de Bruijn <[email protected]> Date: Mon, 25 May 2020 15:07:40 -0400
> From: Willem de Bruijn <[email protected]> > > Syzkaller again found a path to a kernel crash through bad gso input: > a packet with gso size exceeding len. > > These packets are dropped in tcp_gso_segment and udp[46]_ufo_fragment. > But they may affect gso size calculations earlier in the path. > > Now that we have thlen as of commit 9274124f023b ("net: stricter > validation of untrusted gso packets"), check gso_size at entry too. > > Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.") > Reported-by: syzbot <[email protected]> > Signed-off-by: Willem de Bruijn <[email protected]> Applied and queued up for -stable, thanks Willem.
