public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	Alexey Kodanev <alexey.kodanev@oracle.com>,
	Alexander Duyck <alexander.h.duyck@intel.com>,
	"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.13 02/44] gso: fix payload length when gso_size is zero
Date: Thu, 16 Nov 2017 18:42:26 +0100	[thread overview]
Message-ID: <20171116172823.646431297@linuxfoundation.org> (raw)
In-Reply-To: <20171116172823.336649076@linuxfoundation.org>

4.13-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alexey Kodanev <alexey.kodanev@oracle.com>


[ Upstream commit 3d0241d57c7b25bb75ac9d7a62753642264fdbce ]

When gso_size reset to zero for the tail segment in skb_segment(), later
in ipv6_gso_segment(), __skb_udp_tunnel_segment() and gre_gso_segment()
we will get incorrect results (payload length, pcsum) for that segment.
inet_gso_segment() already has a check for gso_size before calculating
payload.

The issue was found with LTP vxlan & gre tests over ixgbe NIC.

Fixes: 07b26c9454a2 ("gso: Support partial splitting at the frag_list pointer")
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
Acked-by: Alexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/gre_offload.c |    2 +-
 net/ipv4/udp_offload.c |    2 +-
 net/ipv6/ip6_offload.c |    2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -98,7 +98,7 @@ static struct sk_buff *gre_gso_segment(s
 		greh = (struct gre_base_hdr *)skb_transport_header(skb);
 		pcsum = (__sum16 *)(greh + 1);
 
-		if (gso_partial) {
+		if (gso_partial && skb_is_gso(skb)) {
 			unsigned int partial_adj;
 
 			/* Adjust checksum to account for the fact that
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -122,7 +122,7 @@ static struct sk_buff *__skb_udp_tunnel_
 		 * will be using a length value equal to only one MSS sized
 		 * segment instead of the entire frame.
 		 */
-		if (gso_partial) {
+		if (gso_partial && skb_is_gso(skb)) {
 			uh->len = htons(skb_shinfo(skb)->gso_size +
 					SKB_GSO_CB(skb)->data_offset +
 					skb->head - (unsigned char *)uh);
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -105,7 +105,7 @@ static struct sk_buff *ipv6_gso_segment(
 
 	for (skb = segs; skb; skb = skb->next) {
 		ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff);
-		if (gso_partial)
+		if (gso_partial && skb_is_gso(skb))
 			payload_len = skb_shinfo(skb)->gso_size +
 				      SKB_GSO_CB(skb)->data_offset +
 				      skb->head - (unsigned char *)(ipv6h + 1);

  parent reply	other threads:[~2017-11-16 17:50 UTC|newest]

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-11-16 17:42 [PATCH 4.13 00/44] 4.13.14-stable review Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 01/44] ppp: fix race in ppp device destruction Greg Kroah-Hartman
2017-11-16 17:42 ` Greg Kroah-Hartman [this message]
2017-11-16 17:42 ` [PATCH 4.13 03/44] ipv4: Fix traffic triggered IPsec connections Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 04/44] ipv6: " Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 05/44] netlink: do not set cb_running if dumps start() errs Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 06/44] net: call cgroup_sk_alloc() earlier in sk_clone_lock() Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 07/44] macsec: fix memory leaks when skb_to_sgvec fails Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 08/44] l2tp: check ps->sock before running pppol2tp_session_ioctl() Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 09/44] tun: call dev_get_valid_name() before register_netdevice() Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 10/44] netlink: fix netlink_ack() extack race Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 11/44] sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 12/44] tcp/dccp: fix ireq->opt races Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 13/44] packet: avoid panic in packet_getsockopt() Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 14/44] geneve: Fix function matching VNI and tunnel ID on big-endian Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 15/44] net: bridge: fix returning of vlan range op errors Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 16/44] soreuseport: fix initialization race Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 17/44] ipv6: flowlabel: do not leave opt->tot_len with garbage Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 18/44] sctp: full support for ipv6 ip_nonlocal_bind & IP_FREEBIND Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 19/44] tcp/dccp: fix lockdep splat in inet_csk_route_req() Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 21/44] net: dsa: check master device before put Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 22/44] net/unix: dont show information about sockets from other namespaces Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 23/44] tap: double-free in error path in tap_open() Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 24/44] net/mlx5: Fix health work queue spin lock to IRQ safe Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 25/44] net/mlx5e: Properly deal with encap flows add/del under neigh update Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 26/44] ipip: only increase err_count for some certain type icmp in ipip_err Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 27/44] ip6_gre: only increase err_count for some certain type icmpv6 in ip6gre_err Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 28/44] ip6_gre: update dst pmtu if dev mtu has been updated by toobig in __gre6_xmit Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 29/44] tcp: refresh tp timestamp before tcp_mtu_probe() Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 30/44] tap: reference to KVA of an unloaded module causes kernel panic Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 31/44] tun: allow positive return values on dev_get_valid_name() call Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 32/44] sctp: reset owner sk for data chunks on out queues when migrating a sock Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 33/44] net_sched: avoid matching qdisc with zero handle Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 34/44] l2tp: hold tunnel in pppol2tp_connect() Greg Kroah-Hartman
2017-11-16 17:42 ` [PATCH 4.13 35/44] tun/tap: sanitize TUNSETSNDBUF input Greg Kroah-Hartman
2017-11-16 17:43 ` [PATCH 4.13 36/44] ipv6: addrconf: increment ifp refcount before ipv6_del_addr() Greg Kroah-Hartman
2017-11-16 17:43 ` [PATCH 4.13 37/44] tcp: fix tcp_mtu_probe() vs highest_sack Greg Kroah-Hartman
2017-11-16 17:43 ` [PATCH 4.13 38/44] mac80211: accept key reinstall without changing anything Greg Kroah-Hartman
2017-11-16 17:43 ` [PATCH 4.13 39/44] mac80211: use constant time comparison with keys Greg Kroah-Hartman
2017-11-16 17:43 ` [PATCH 4.13 40/44] mac80211: dont compare TKIP TX MIC key in reinstall prevention Greg Kroah-Hartman
2017-11-16 17:43 ` [PATCH 4.13 41/44] usb: usbtest: fix NULL pointer dereference Greg Kroah-Hartman
2017-11-16 17:43 ` [PATCH 4.13 42/44] Input: ims-psu - check if CDC union descriptor is sane Greg Kroah-Hartman
2017-11-16 17:43 ` [PATCH 4.13 43/44] EDAC, sb_edac: Dont create a second memory controller if HA1 is not present Greg Kroah-Hartman
2017-11-16 17:43 ` [PATCH 4.13 44/44] dmaengine: dmatest: warn user when dma test times out Greg Kroah-Hartman
2017-11-16 22:45 ` [PATCH 4.13 00/44] 4.13.14-stable review Shuah Khan
2017-11-17  8:10   ` Greg Kroah-Hartman
2017-11-17  2:03 ` Guenter Roeck
2017-11-17  8:11   ` Greg Kroah-Hartman
     [not found] ` <5a0e2714.c5badf0a.3983c.7eaa@mx.google.com>
2017-11-17  8:14   ` Greg Kroah-Hartman
2017-11-18  0:41     ` Kevin Hilman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171116172823.646431297@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=alexander.h.duyck@intel.com \
    --cc=alexey.kodanev@oracle.com \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox