Re: [PATCH net] udp: fix a potential panic in first_packet_length()

2017-02-09 Thread Eric Dumazet
On Thu, 2017-02-09 at 18:01 +0100, Paolo Abeni wrote: > > > My bad, I missed completely that call path. > > I'm wondering if calling first_packet_length() for l2tp_ip sockets > makes sense ?!? Am I missing something or it touches udp stats and > checks udp csum for non udp packets ?!? Yes, I g

Re: [PATCH net] udp: fix a potential panic in first_packet_length()

2017-02-09 Thread Paolo Abeni
On Thu, 2017-02-09 at 07:30 -0800, Eric Dumazet wrote: > From: Eric Dumazet > > first_packet_length() is called from udp_ioctl() > > udp_ioctl(), as its name suggests, is used by UDP protocols, > but is also used by L2TP :( > > We shall call udp_rmem_release() only for UDP variants. > > Thanks

[PATCH net] udp: fix a potential panic in first_packet_length()

2017-02-09 Thread Eric Dumazet
From: Eric Dumazet first_packet_length() is called from udp_ioctl() udp_ioctl(), as its name suggests, is used by UDP protocols, but is also used by L2TP :( We shall call udp_rmem_release() only for UDP variants. Thanks to Andrey and syzkaller team for providing the report and a nice reproduce