Received-SPF: pass (google.com: domain of linux-kernel+bounces-171240-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
References: <20240507094114.67716-1-nbd@nbd.name>
In-Reply-To: <20240507094114.67716-1-nbd@nbd.name>
From: Eric Dumazet <edumazet@google.com>
Date: Tue, 7 May 2024 14:08:59 +0200
Message-ID: <CANn89i+kjcpuh8ecKkZKkKFGv2nTZxp1BA+BSgyPvSXLX-yfwg@mail.gmail.com>
Subject: Re: [PATCH net-next] net: add missing check for TCP fraglist GRO
To: Felix Fietkau <nbd@nbd.name>
Cc: netdev@vger.kernel.org, "David S. Miller" <davem@davemloft.net>, 
	David Ahern <dsahern@kernel.org>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, 
	Willem de Bruijn <willemb@google.com>, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, May 7, 2024 at 11:41=E2=80=AFAM Felix Fietkau <nbd@nbd.name> wrote:
>
> It turns out that the existing checks do not guarantee that the skb can b=
e
> pulled up to the GRO offset. When using the usb r8152 network driver with
> GRO fraglist, the BUG() in __skb_pull is often triggered.

Why is it crashing ? I would expect tcp_gro_pull_header() to perform this e=
arly.

Please include a stack trace.

> Fix the crash by adding the missing check.
>
> Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO")
> Signed-off-by: Felix Fietkau <nbd@nbd.name>
> ---
>  net/ipv4/tcp_offload.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
> index c90704befd7b..a71d2e623f0c 100644
> --- a/net/ipv4/tcp_offload.c
> +++ b/net/ipv4/tcp_offload.c
> @@ -353,6 +353,7 @@ struct sk_buff *tcp_gro_receive(struct list_head *hea=
d, struct sk_buff *skb,
>                 flush |=3D (__force int)(flags ^ tcp_flag_word(th2));
>                 flush |=3D skb->ip_summed !=3D p->ip_summed;
>                 flush |=3D skb->csum_level !=3D p->csum_level;
> +               flush |=3D !pskb_may_pull(skb, skb_gro_offset(skb));
>                 flush |=3D NAPI_GRO_CB(p)->count >=3D 64;
>
>                 if (flush || skb_gro_receive_list(p, skb))
> --
> 2.44.0
>