From patchwork Tue Nov 17 12:44:14 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Herbert Xu X-Patchwork-Id: 38629 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by ozlabs.org (Postfix) with ESMTP id 85D651007D3 for ; Tue, 17 Nov 2009 23:44:23 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752372AbZKQMoL (ORCPT ); Tue, 17 Nov 2009 07:44:11 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752194AbZKQMoL (ORCPT ); Tue, 17 Nov 2009 07:44:11 -0500 Received: from rhun.apana.org.au ([64.62.148.172]:43428 "EHLO arnor.apana.org.au" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751445AbZKQMoL (ORCPT ); Tue, 17 Nov 2009 07:44:11 -0500 Received: from gondolin.me.apana.org.au ([192.168.0.6]) by arnor.apana.org.au with esmtp (Exim 4.63 #1 (Debian)) id 1NANPs-0008Vb-29; Tue, 17 Nov 2009 23:44:16 +1100 Received: from herbert by gondolin.me.apana.org.au with local (Exim 4.69) (envelope-from ) id 1NANPq-0003ua-F6; Tue, 17 Nov 2009 20:44:14 +0800 Date: Tue, 17 Nov 2009 20:44:14 +0800 From: Herbert Xu To: "David S. Miller" , netdev@vger.kernel.org Cc: Mark Wagner Subject: gro: Fix illegal merging of trailer trash Message-ID: <20091117124414.GA14951@gondor.apana.org.au> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hi Dave: Just found this thanks to Mark Wagner testing GRO with Xen. We'll need this for stable too. gro: Fix illegal merging of trailer trash When we've merged skb's with page frags, and subsequently receive a trailer skb (< MSS) that is not completely non-linear (this can occur on Intel NICs if the packet size falls below the threshold), GRO ends up producing an illegal GSO skb with a frag_list. This is harmless unless the skb is then forwarded through an interface that requires software GSO, whereupon the GSO code will BUG. This patch detects this case in GRO and avoids merging the trailer skb. Reported-by: Mark Wagner Signed-off-by: Herbert Xu Thanks, diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 80a9616..ec85681 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2701,7 +2701,8 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb) NAPI_GRO_CB(skb)->free = 1; goto done; - } + } else if (skb_gro_len(p) != pinfo->gso_size) + return -E2BIG; headroom = skb_headroom(p); nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));