Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 29e98242 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: gro: make sure skb->cb[] initial content has not to be zero 



Starting from linux-3.13, GRO attempts to build full size skbs.

Problem is the commit assumed one particular field in skb->cb[]
was clean, but it is not the case on some stacked devices.

Timo reported a crash in case traffic is decrypted before
reaching a GRE device.

Fix this by initializing NAPI_GRO_CB(skb)->last at the right place,
this also removes one conditional.

Thanks a lot to Timo for providing full reports and bisecting this.

Fixes: 8a29111c ("net: gro: allow to build full sized skb")
Bisected-by: default avatarTimo Teras <timo.teras@iki.fi>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Tested-by: default avatarTimo Teräs <timo.teras@iki.fi>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 22fb22ea

net/core/dev.c

+1 −0
Original line number Diff line number Diff line
@@ -3951,6 +3951,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff 
	}

	NAPI_GRO_CB(skb)->count = 1;

	NAPI_GRO_CB(skb)->age = jiffies;

	NAPI_GRO_CB(skb)->last = skb;

	skb_shinfo(skb)->gso_size = skb_gro_len(skb);

	skb->next = napi->gro_list;

	napi->gro_list = skb;

net/core/skbuff.c

+2 −2
Original line number Diff line number Diff line
@@ -3076,7 +3076,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb) 
	if (unlikely(p->len + len >= 65536))

		return -E2BIG;



	lp = NAPI_GRO_CB(p)->last ?: p;

	lp = NAPI_GRO_CB(p)->last;

	pinfo = skb_shinfo(lp);



	if (headlen <= offset) {
@@ -3192,7 +3192,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb) 


	__skb_pull(skb, offset);



	if (!NAPI_GRO_CB(p)->last)

	if (NAPI_GRO_CB(p)->last == p)

		skb_shinfo(p)->frag_list = skb;

	else

		NAPI_GRO_CB(p)->last->next = skb;