| Message ID | 20091117124414.GA14951@gondor.apana.org.au |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
From: Herbert Xu <herbert@gondor.apana.org.au> Date: Tue, 17 Nov 2009 20:44:14 +0800 > gro: Fix illegal merging of trailer trash > > When we've merged skb's with page frags, and subsequently receive > a trailer skb (< MSS) that is not completely non-linear (this can > occur on Intel NICs if the packet size falls below the threshold), > GRO ends up producing an illegal GSO skb with a frag_list. > > This is harmless unless the skb is then forwarded through an > interface that requires software GSO, whereupon the GSO code > will BUG. > > This patch detects this case in GRO and avoids merging the > trailer skb. > > Reported-by: Mark Wagner <mwagner@redhat.com> > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Applied, and queued up for -stable, thanks. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 80a9616..ec85681 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2701,7 +2701,8 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb) NAPI_GRO_CB(skb)->free = 1; goto done; - } + } else if (skb_gro_len(p) != pinfo->gso_size) + return -E2BIG; headroom = skb_headroom(p); nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
Hi Dave: Just found this thanks to Mark Wagner testing GRO with Xen. We'll need this for stable too. gro: Fix illegal merging of trailer trash When we've merged skb's with page frags, and subsequently receive a trailer skb (< MSS) that is not completely non-linear (this can occur on Intel NICs if the packet size falls below the threshold), GRO ends up producing an illegal GSO skb with a frag_list. This is harmless unless the skb is then forwarded through an interface that requires software GSO, whereupon the GSO code will BUG. This patch detects this case in GRO and avoids merging the trailer skb. Reported-by: Mark Wagner <mwagner@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Thanks,