Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 36a8f39e authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: skb_is_gso_v6() requires skb_is_gso() 



bnx2x makes a dangerous use of skb_is_gso_v6().

It should first make sure skb is a gso packet

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Eilon Greenstein <eilong@broadcom.com>
Acked-by: default avatarDmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c3f40d7c

drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c

+10 −8
Original line number Diff line number Diff line
@@ -3256,15 +3256,17 @@ static u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb) 
	if (prot == IPPROTO_TCP)

		rc |= XMIT_CSUM_TCP;



	if (skb_is_gso(skb)) {

		if (skb_is_gso_v6(skb)) {

			rc |= (XMIT_GSO_V6 | XMIT_CSUM_TCP);

			if (rc & XMIT_CSUM_ENC)

				rc |= XMIT_GSO_ENC_V6;

	} else if (skb_is_gso(skb)) {

		} else {

			rc |= (XMIT_GSO_V4 | XMIT_CSUM_TCP);

			if (rc & XMIT_CSUM_ENC)

				rc |= XMIT_GSO_ENC_V4;

		}

	}



	return rc;

}

include/linux/skbuff.h

+1 −0
Original line number Diff line number Diff line
@@ -2755,6 +2755,7 @@ static inline bool skb_is_gso(const struct sk_buff *skb) 
	return skb_shinfo(skb)->gso_size;

}



/* Note: Should be called only if skb_is_gso(skb) is true */

static inline bool skb_is_gso_v6(const struct sk_buff *skb)

{

	return skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6;