Revert "udp: consistently apply ufo or fragmentation"

This reverts commit 5967f2e74e50c277759c900e415a5ef49ac1c635.

CVE-2017-1000112

Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 49e9b2bc6e3329b263cb97a16e7ed5869506be6a..9f6c8631446c26a4bb59f04dad444e9504ac3841 100644 (file)
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -958,12 +958,11 @@ static int __ip_append_data(struct sock *sk,
                csummode = CHECKSUM_PARTIAL;
 
        cork->length += length;
-       if ((skb && skb_is_gso(skb)) ||
-           (((length + (skb ? skb->len : fragheaderlen)) > mtu) &&
-           (skb_queue_len(queue) <= 1) &&
+       if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
+            (skb && skb_is_gso(skb))) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-           (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) {
+           (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
                err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                         hh_len, fragheaderlen, transhdrlen,
                                         maxfraglen, flags);
@@ -1279,7 +1278,6 @@ ssize_t   ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                return -EINVAL;
 
        if ((size + skb->len > mtu) &&
-           (skb_queue_len(&sk->sk_write_queue) == 1) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO)) {
                if (skb->ip_summed != CHECKSUM_PARTIAL)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index b65ce893f1cb88eaf7272c40550d9d0c10108ef6..71c6ee05a42275efdd1f61e74a4bd26cc97efa6d 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1386,12 +1386,11 @@ emsgsize:
         */
 
        cork->length += length;
-       if ((skb && skb_is_gso(skb)) ||
-           (((length + (skb ? skb->len : headersize)) > mtu) &&
-           (skb_queue_len(queue) <= 1) &&
+       if ((((length + (skb ? skb->len : headersize)) > mtu) ||
+            (skb && skb_is_gso(skb))) &&
            (sk->sk_protocol == IPPROTO_UDP) &&
            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
-           (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) {
+           (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
                err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, exthdrlen,
                                          transhdrlen, mtu, flags, fl6);