Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

fou: Don't allow 0 for FOU_ATTR_IPPROTO.

fou_udp_recv() has the same problem mentioned in the previous
patch.

If FOU_ATTR_IPPROTO is set to 0, skb is not freed by
fou_udp_recv() nor "resubmit"-ted in ip_protocol_deliver_rcu().

Let's forbid 0 for FOU_ATTR_IPPROTO.

Fixes: 23461551c0062 ("fou: Support for foo-over-udp RX path")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260115172533.693652-4-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Kuniyuki Iwashima and committed by
Jakub Kicinski
7a9bc9e3 68578370

+3 -1
+2
Documentation/netlink/specs/fou.yaml
··· 39 39 - 40 40 name: ipproto 41 41 type: u8 42 + checks: 43 + min: 1 42 44 - 43 45 name: type 44 46 type: u8
+1 -1
net/ipv4/fou_nl.c
··· 15 15 const struct nla_policy fou_nl_policy[FOU_ATTR_IFINDEX + 1] = { 16 16 [FOU_ATTR_PORT] = { .type = NLA_BE16, }, 17 17 [FOU_ATTR_AF] = { .type = NLA_U8, }, 18 - [FOU_ATTR_IPPROTO] = { .type = NLA_U8, }, 18 + [FOU_ATTR_IPPROTO] = NLA_POLICY_MIN(NLA_U8, 1), 19 19 [FOU_ATTR_TYPE] = { .type = NLA_U8, }, 20 20 [FOU_ATTR_REMCSUM_NOPARTIAL] = { .type = NLA_FLAG, }, 21 21 [FOU_ATTR_LOCAL_V4] = { .type = NLA_U32, },