Messages in this thread Patch in this message | | | Date | Wed, 16 Dec 2009 17:15:02 -0800 | From | Greg KH <> | Subject | [51/90] gro: Fix illegal merging of trailer trash |
| |
2.6.31-stable review patch. If anyone has any objections, please let us know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 69c0cab120a85471054614418b447349caba22d7 ]
When we've merged skb's with page frags, and subsequently receive a trailer skb (< MSS) that is not completely non-linear (this can occur on Intel NICs if the packet size falls below the threshold), GRO ends up producing an illegal GSO skb with a frag_list.
This is harmless unless the skb is then forwarded through an interface that requires software GSO, whereupon the GSO code will BUG.
This patch detects this case in GRO and avoids merging the trailer skb.
Reported-by: Mark Wagner <mwagner@redhat.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> --- net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2704,7 +2704,8 @@ int skb_gro_receive(struct sk_buff **hea NAPI_GRO_CB(skb)->free = 1; goto done; - } + } else if (skb_gro_len(p) != pinfo->gso_size) + return -E2BIG; headroom = skb_headroom(p); nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
| |