netdev - Re: [PATCH net] net: fix segmentation after TCP/UDP fraglist GRO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5a787632-97cb-479e-897c-6e9034d9dfde@nbd.name>
Date: Thu, 10 Jul 2025 13:58:32 +0200
From: Felix Fietkau <nbd@....name>
To: Richard Gobert <richardbgobert@...il.com>, netdev@...r.kernel.org,
 Eric Dumazet <edumazet@...gle.com>, Neal Cardwell <ncardwell@...gle.com>,
 Kuniyuki Iwashima <kuniyu@...gle.com>, "David S. Miller"
 <davem@...emloft.net>, David Ahern <dsahern@...nel.org>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 Simon Horman <horms@...nel.org>, Willem de Bruijn <willemb@...gle.com>
Cc: linux-kernel@...r.kernel.org
Subject: Re: [PATCH net] net: fix segmentation after TCP/UDP fraglist GRO

On 10.07.25 13:37, Richard Gobert wrote:
> Felix Fietkau wrote:
>> Since "net: gro: use cb instead of skb->network_header", the skb network
>> header is no longer set in the GRO path.
>> This breaks fraglist segmentation, which relies on ip_hdr()/tcp_hdr()
>> to check for address/port changes.
>> Fix this regression by selectively setting the network header for merged
>> segment skbs.
>> 
>> Fixes: 186b1ea73ad8 ("net: gro: use cb instead of skb->network_header")
>> Signed-off-by: Felix Fietkau <nbd@....name>
>> ---
>>  net/ipv4/tcp_offload.c | 1 +
>>  net/ipv4/udp_offload.c | 1 +
>>  2 files changed, 2 insertions(+)
>> 
>> diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
>> index d293087b426d..be5c2294610e 100644
>> --- a/net/ipv4/tcp_offload.c
>> +++ b/net/ipv4/tcp_offload.c
>> @@ -359,6 +359,7 @@ struct sk_buff *tcp_gro_receive(struct list_head *head, struct sk_buff *skb,
>>  		flush |= skb->ip_summed != p->ip_summed;
>>  		flush |= skb->csum_level != p->csum_level;
>>  		flush |= NAPI_GRO_CB(p)->count >= 64;
>> +		skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
>>  
>>  		if (flush || skb_gro_receive_list(p, skb))
>>  			mss = 1;
>> diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
>> index 85b5aa82d7d7..e0a6bfa95118 100644
>> --- a/net/ipv4/udp_offload.c
>> +++ b/net/ipv4/udp_offload.c
>> @@ -767,6 +767,7 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,
>>  					NAPI_GRO_CB(skb)->flush = 1;
>>  					return NULL;
>>  				}
>> +				skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
>>  				ret = skb_gro_receive_list(p, skb);
>>  			} else {
>>  				skb_gro_postpull_rcsum(skb, uh,
> 
> Were you able to reproduce this regression? If so, can you share how?

This was reported by several OpenWrt users after upgrading from Linux 
6.6 to 6.12. OpenWrt enables fraglist GRO by default. From the reports, 
the issues appeared when bridging packets through a VLAN filtering 
bridge from DSA ports to a WLAN device.

- Felix