Skip to content
  • Stefano Brivio's avatar
    fou: Prevent unbounded recursion in GUE error handler · 11789039
    Stefano Brivio authored
    
    
    Handling exceptions for direct UDP encapsulation in GUE (that is,
    UDP-in-UDP) leads to unbounded recursion in the GUE exception handler,
    syzbot reported.
    
    While draft-ietf-intarea-gue-06 doesn't explicitly forbid direct
    encapsulation of UDP in GUE, it probably doesn't make sense to set up GUE
    this way, and it's currently not even possible to configure this.
    
    Skip exception handling if the GUE proto/ctype field is set to the UDP
    protocol number. Should we need to handle exceptions for UDP-in-GUE one
    day, we might need to either explicitly set a bound for recursion, or
    implement a special iterative handling for these cases.
    
    Reported-and-tested-by: default avatar <syzbot+43f6755d1c2e62743468@syzkaller.appspotmail.com>
    Fixes: b8a51b38
    
     ("fou, fou6: ICMP error handlers for FoU and GUE")
    Signed-off-by: default avatarStefano Brivio <sbrivio@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    11789039