[PATCH 5.4 07/34] udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments

[Greg Kroah-Hartman]

From: Xin Long <lucien....@gmail.com>

[ Upstream commit 10c678bd0a035ac2c64a9b26b222f20556227a53 ]

Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the
proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu().
Otherwize, with a negtive value passed, it will underflow inet_protos.

This can be reproduced with IPIP FOU:

  # ip fou add port 5555 ipproto 4
  # ethtool -K eth1 rx-gro-list on

Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection")
Reported-by: Guillaume Nault <gna...@redhat.com>
Signed-off-by: Xin Long <lucien....@gmail.com>
Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 net/ipv4/udp.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2117,7 +2117,7 @@ static int udp_queue_rcv_skb(struct sock
                __skb_pull(skb, skb_transport_offset(skb));
                ret = udp_queue_rcv_one_skb(sk, skb);
                if (ret > 0)
-                       ip_protocol_deliver_rcu(dev_net(skb->dev), skb, -ret);
+                       ip_protocol_deliver_rcu(dev_net(skb->dev), skb, ret);
        }
        return 0;
 }