Received-SPF: pass (google.com: domain of linux-kernel+bounces-171226-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Tue, 07 May 2024 07:51:13 -0400
From: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
To: Suman Ghosh <sumang@marvell.com>, 
 Felix Fietkau <nbd@nbd.name>, 
 "netdev@vger.kernel.org" <netdev@vger.kernel.org>, 
 Eric Dumazet <edumazet@google.com>, 
 "David S. Miller" <davem@davemloft.net>, 
 David Ahern <dsahern@kernel.org>, 
 Jakub Kicinski <kuba@kernel.org>, 
 Paolo Abeni <pabeni@redhat.com>, 
 Willem de Bruijn <willemb@google.com>
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Message-ID: <663a15b153de_726ea29475@willemb.c.googlers.com.notmuch>
In-Reply-To: <SJ0PR18MB521604310B1F7DC297C2870DDBE42@SJ0PR18MB5216.namprd18.prod.outlook.com>
References: <20240507094114.67716-1-nbd@nbd.name>
 <SJ0PR18MB521604310B1F7DC297C2870DDBE42@SJ0PR18MB5216.namprd18.prod.outlook.com>
Subject: RE: [EXTERNAL] [PATCH net-next] net: add missing check for TCP
 fraglist GRO
Precedence: bulk
Mime-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: 7bit

Suman Ghosh wrote:
> >----------------------------------------------------------------------
> >It turns out that the existing checks do not guarantee that the skb can be
> >pulled up to the GRO offset. When using the usb r8152 network driver with
> >GRO fraglist, the BUG() in __skb_pull is often triggered.
> >Fix the crash by adding the missing check.
> >
> >Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO")

> [Suman] Since this is a fix, this should be pushed to "net".

The referenced patch has only landed in net-next yet.

> >Signed-off-by: Felix Fietkau <nbd@nbd.name>

Reviewed-by: Willem de Bruijn <willemb@google.com>

> >---
> > net/ipv4/tcp_offload.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> >diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c index
> >c90704befd7b..a71d2e623f0c 100644
> >--- a/net/ipv4/tcp_offload.c
> >+++ b/net/ipv4/tcp_offload.c
> >@@ -353,6 +353,7 @@ struct sk_buff *tcp_gro_receive(struct list_head *head,
> >struct sk_buff *skb,
> > 		flush |= (__force int)(flags ^ tcp_flag_word(th2));
> > 		flush |= skb->ip_summed != p->ip_summed;
> > 		flush |= skb->csum_level != p->csum_level;
> >+		flush |= !pskb_may_pull(skb, skb_gro_offset(skb));
> > 		flush |= NAPI_GRO_CB(p)->count >= 64;

The same check already exists in udp_gro_receive, which has for longer
been calling skb_gro_receive_list:

       if (!pskb_may_pull(skb, skb_gro_offset(skb))) {
               NAPI_GRO_CB(skb)->flush = 1;
               return NULL;
       }
 
Alternatively it would make sense to deduplicate the check and move it
to skb_gro_receive_list itself, before

        skb_pull(skb, skb_gro_offset(skb));