bareudp: Fix invalid read beyond skb's linear data
authorGuillaume Nault <gnault@redhat.com>
Fri, 6 Aug 2021 15:52:06 +0000 (17:52 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 18 Aug 2021 06:59:11 +0000 (08:59 +0200)
commit00a0c11ddd72c85a71335b0b5b28738c37093632
tree495c1178a295476abd4f7b0848a891cfa227119a
parent30b1fc47f7657da952a20c16892e8d21190eefbf
bareudp: Fix invalid read beyond skb's linear data

[ Upstream commit 143a8526ab5fd4f8a0c4fe2a9cb28c181dc5a95f ]

Data beyond the UDP header might not be part of the skb's linear data.
Use skb_copy_bits() instead of direct access to skb->data+X, so that
we read the correct bytes even on a fragmented skb.

Fixes: 4b5f67232d95 ("net: Special handling for IP & MPLS.")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Link: https://lore.kernel.org/r/7741c46545c6ef02e70c80a9b32814b22d9616b3.1628264975.git.gnault@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/bareudp.c