inet: protect against too small mtu values.

[mirror_ubuntu-bionic-kernel.git] / net / ipv4 / ip_output.c

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 34d49f76d1a7203dc64264000c99f00eb620010e..73cd64c7692f9d109bef25f618928d1db8a795a6 100644 (file)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1123,13 +1123,17 @@ static int ip_setup_cork(struct sock *sk, struct inet_cork *cork,
        rt = *rtp;
        if (unlikely(!rt))
                return -EFAULT;
-       /*
-        * We steal reference to this route, caller should not release it
-        */
-       *rtp = NULL;
+
        cork->fragsize = ip_sk_use_pmtu(sk) ?
-                        dst_mtu(&rt->dst) : rt->dst.dev->mtu;
+                        dst_mtu(&rt->dst) : READ_ONCE(rt->dst.dev->mtu);
+
+       if (!inetdev_valid_mtu(cork->fragsize))
+               return -ENETUNREACH;
+
        cork->dst = &rt->dst;
+       /* We stole this route, caller should not release it. */
+       *rtp = NULL;
+
        cork->length = 0;
        cork->ttl = ipc->ttl;
        cork->tos = ipc->tos;