1 files changed, 18 insertions, 6 deletions

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ef29df8648e4..5676237d2b0f 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2221,9 +2221,10 @@ static struct sock *__udp4_lib_demux_lookup(struct net *net,
         return NULL;
 }
 
-void udp_v4_early_demux(struct sk_buff *skb)
+int udp_v4_early_demux(struct sk_buff *skb)
 {
         struct net *net = dev_net(skb->dev);
+        struct in_device *in_dev = NULL;
         const struct iphdr *iph;
         const struct udphdr *uh;
         struct sock *sk = NULL;
@@ -2234,24 +2235,24 @@ void udp_v4_early_demux(struct sk_buff *skb)
 
         /* validate the packet */
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct udphdr)))
-                return;
+                return 0;
 
         iph = ip_hdr(skb);
         uh = udp_hdr(skb);
 
         if (skb->pkt_type == PACKET_BROADCAST ||
             skb->pkt_type == PACKET_MULTICAST) {
-                struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+                in_dev = __in_dev_get_rcu(skb->dev);
 
                 if (!in_dev)
-                        return;
+                        return 0;
 
                 /* we are supposed to accept bcast packets */
                 if (skb->pkt_type == PACKET_MULTICAST) {
                         ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
                                                iph->protocol);
                         if (!ours)
-                                return;
+                                return 0;
                 }
 
                 sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
@@ -2263,7 +2264,7 @@ void udp_v4_early_demux(struct sk_buff *skb)
         }
 
         if (!sk || !refcount_inc_not_zero(&sk->sk_refcnt))
-                return;
+                return 0;
 
         skb->sk = sk;
         skb->destructor = sock_efree;
@@ -2272,12 +2273,23 @@ void udp_v4_early_demux(struct sk_buff *skb)
         if (dst)
                 dst = dst_check(dst, 0);
         if (dst) {
+                u32 itag = 0;
+
                 /* set noref for now.
                  * any place which wants to hold dst has to call
                  * dst_hold_safe()
                  */
                 skb_dst_set_noref(skb, dst);
+
+                /* for unconnected multicast sockets we need to validate
+                 * the source on each packet
+                 */
+                if (!inet_sk(sk)->inet_daddr && in_dev)
+                        return ip_mc_validate_source(skb, iph->daddr,
+                                                     iph->saddr, iph->tos,
+                                                     skb->dev, in_dev, &itag);
         }
+        return 0;
 }
 
 int udp_rcv(struct sk_buff *skb)