linux-kernel - RE: [EXTERNAL] [PATCH net-next] net: add missing check for TCP fraglist GRO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: 
 <SJ0PR18MB521604310B1F7DC297C2870DDBE42@SJ0PR18MB5216.namprd18.prod.outlook.com>
Date: Tue, 7 May 2024 11:33:16 +0000
From: Suman Ghosh <sumang@...vell.com>
To: Felix Fietkau <nbd@....name>,
        "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>,
        Eric Dumazet <edumazet@...gle.com>,
        "David S.
 Miller" <davem@...emloft.net>,
        David Ahern <dsahern@...nel.org>, Jakub
 Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Willem de Bruijn
	<willemb@...gle.com>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [EXTERNAL] [PATCH net-next] net: add missing check for TCP
 fraglist GRO

>----------------------------------------------------------------------
>It turns out that the existing checks do not guarantee that the skb can be
>pulled up to the GRO offset. When using the usb r8152 network driver with
>GRO fraglist, the BUG() in __skb_pull is often triggered.
>Fix the crash by adding the missing check.
>
>Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO")
[Suman] Since this is a fix, this should be pushed to "net".
>Signed-off-by: Felix Fietkau <nbd@....name>
>---
> net/ipv4/tcp_offload.c | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c index
>c90704befd7b..a71d2e623f0c 100644
>--- a/net/ipv4/tcp_offload.c
>+++ b/net/ipv4/tcp_offload.c
>@@ -353,6 +353,7 @@ struct sk_buff *tcp_gro_receive(struct list_head *head,
>struct sk_buff *skb,
> 		flush |= (__force int)(flags ^ tcp_flag_word(th2));
> 		flush |= skb->ip_summed != p->ip_summed;
> 		flush |= skb->csum_level != p->csum_level;
>+		flush |= !pskb_may_pull(skb, skb_gro_offset(skb));
> 		flush |= NAPI_GRO_CB(p)->count >= 64;
>
> 		if (flush || skb_gro_receive_list(p, skb))
>--
>2.44.0
>