Revert "udp: consistently apply ufo or fragmentation"

This reverts commit 840d468de3a32ee65969a8f4245b850e275c1ef6.

CVE-2017-1000112

Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 22e6ded344c17a13bf15675b03a7829c5fa9096f..423558b546ea649d95eb0736a7303d8153053105 100644 (file)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -922,12 +922,11 @@ static int __ip_append_data(struct sock *sk,
                csummode = CHECKSUM_PARTIAL;
 
        cork->length += length;
-       if ((skb && skb_is_gso(skb)) ||
-           (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
-           (skb_queue_len(queue) <= 1) &&
+       if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
+            (skb && skb_is_gso(skb))) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-           (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
+           (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
                err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                         hh_len, fragheaderlen, transhdrlen,
                                         maxfraglen, flags);
@@ -1243,7 +1242,6 @@ ssize_t   ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                return -EINVAL;
 
        if ((size + skb->len > mtu) &&
-           (skb_queue_len(&sk->sk_write_queue) == 1) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO)) {
                if (skb->ip_summed != CHECKSUM_PARTIAL)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4a4840cda6b8c6ed5cf249c6737dad73e18a1bc2..c9f62e2d4c0889d6bbfbe5d2a531c1a051793546 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1361,12 +1361,11 @@ emsgsize:
         */
 
        cork->length += length;
-       if ((skb && skb_is_gso(skb)) ||
-           (((length + (skb ? skb->len : headersize)) > mtu) &&
-           (skb_queue_len(queue) <= 1) &&
+       if ((((length + (skb ? skb->len : headersize)) > mtu) ||
+            (skb && skb_is_gso(skb))) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-           (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
+           (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
                err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, exthdrlen,
                                          transhdrlen, mtu, flags, fl6);