portugalfuturista/openwrt-pf
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

kernel: drop redundant TCP fraglist GRO pull check

Browse source 
The patch adds a pre-check to tcp_gro_receive() so that an skb which
cannot be pulled up to the GRO offset is flushed instead of reaching the
BUG() in __skb_pull(). Upstream has since fixed the same bug inside the
callee, which leaves the pre-check with nothing to protect:

  commit f2bb3434544454099a5b6dec213567267b05d79d
  ("net: add pskb_may_pull() to skb_gro_receive_list()")

skb_gro_receive_list() now rejects the short skb itself and pulls with
skb_pull() rather than the __skb_pull() that carries the BUG(). It is
the only function the is_flist branch of tcp_gro_receive() calls, so no
path is left uncovered. The fix is present in both pinned kernels,
6.12.100 and 6.18.41.

Dropping the pre-check also restores upstream's intended handling: on
failure skb_gro_receive_list() sets NAPI_GRO_CB(skb)->flush, so the skb
is delivered through the normal receive path instead of being held as a
new GRO head. Short-circuiting on the local flush skipped that.

The patch keeps applying cleanly only because the fix landed in a
different function.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/24524
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit is contained in:
Julius Bairaktaris 2026-08-02 00:20:35 +02:00 committed by Jonas Jelonek
parent 2a837da774
commit 12a5e56a64
No known key found for this signature in database
2 changed files with 0 additions and 52 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
target/linux/generic/pending-6.12/690-net-add-missing-check-for-TCP-fraglist-GRO.patch
View file

@ -1,26 +0,0 @@
From 4498f0aa561092bc656bfabe7c4bdae41bc4a5b4 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Tue, 7 May 2024 11:24:50 +0200
Subject: [PATCH] net: add missing check for TCP fraglist GRO
It turns out that the existing checks do not guarantee that the skb can be
pulled up to the GRO offset. When using the usb r8152 network driver with
GRO fraglist, the BUG() in __skb_pull is often triggered.
Fix the crash by adding the missing check.
Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
net/ipv4/tcp_offload.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -355,6 +355,7 @@ struct sk_buff *tcp_gro_receive(struct l
flush |= (__force int)(flags ^ tcp_flag_word(th2));
flush |= skb->ip_summed != p->ip_summed;
flush |= skb->csum_level != p->csum_level;
+ flush |= !pskb_may_pull(skb, skb_gro_offset(skb));
flush |= NAPI_GRO_CB(p)->count >= 64;
skb_set_network_header(skb, skb_gro_receive_network_offset(skb));

26
target/linux/generic/pending-6.18/690-net-add-missing-check-for-TCP-fraglist-GRO.patch
View file

@ -1,26 +0,0 @@
From 4498f0aa561092bc656bfabe7c4bdae41bc4a5b4 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Tue, 7 May 2024 11:24:50 +0200
Subject: [PATCH] net: add missing check for TCP fraglist GRO
It turns out that the existing checks do not guarantee that the skb can be
pulled up to the GRO offset. When using the usb r8152 network driver with
GRO fraglist, the BUG() in __skb_pull is often triggered.
Fix the crash by adding the missing check.
Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
net/ipv4/tcp_offload.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -359,6 +359,7 @@ struct sk_buff *tcp_gro_receive(struct l
flush |= (__force int)(flags ^ tcp_flag_word(th2));
flush |= skb->ip_summed != p->ip_summed;
flush |= skb->csum_level != p->csum_level;
+ flush |= !pskb_may_pull(skb, skb_gro_offset(skb));
flush |= NAPI_GRO_CB(p)->count >= 64;
skb_set_network_header(skb, skb_gro_receive_network_offset(skb));