[UDP]: Fix length check.

Rémi Denis-Courmont wrote:
> Right. By the way, shouldn't "len" rather be signed in there?
>
> 		unsigned int len;
>
> 		/* if we're overly short, let UDP handle it */
> 		len = skb->len - sizeof(struct udphdr);
> 		if (len <= 0)
> 			goto udp;

It should, but the < 0 case can't happen since __udp4_lib_rcv
already makes sure that we have at least a complete UDP header.

Anyways, this patch fixes it.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4ec4a25a8d0cb9b0f6ff4c1dd1d9371566d32a6c..28355350fb62f11b008751769c95b31a22c42039 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -951,14 +951,10 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                 * >0 if skb should be passed on to UDP.
                 * <0 if skb should be resubmitted as proto -N
                 */
-               unsigned int len;
 
                /* if we're overly short, let UDP handle it */
-               len = skb->len - sizeof(struct udphdr);
-               if (len <= 0)
-                       goto udp;
-
-               if (up->encap_rcv != NULL) {
+               if (skb->len > sizeof(struct udphdr) &&
+                   up->encap_rcv != NULL) {
                        int ret;
 
                        ret = (*up->encap_rcv)(sk, skb);
@@ -971,7 +967,6 @@ int udp_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                /* FALLTHROUGH -- it's a UDP Packet */
        }
 
-udp:
        /*
         *      UDP-Lite specific tests, ignored on UDP sockets
         */