From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A9EB83D413C for ; Wed, 8 Apr 2026 17:23:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775668994; cv=none; b=kDqU6OCLKH7jRiEqqSSka7TnJpPvHauHn8wWNlBzxqaLj7mESjAdlekv0pzF7/2OYfcMQjO0W3j1u8Kx3f6QSJo+f6YSl1gZmoxfu+mmeVHp8Y2LR9hAIaUDylnJOJn9IpQ0NQMIiI5I7kcArmDJGdubjIwiXircrdK5T93oY+8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775668994; c=relaxed/simple; bh=tWeqvg5Qcqs811GG/KcpLYamIBa5u78Lc9G8YV4+SMo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=gt9A4Bpa6xYXPwONLJ/zzOUOTbJQQZsNIV4y1q3/A4KnQ1Sc1KH1qoTUuxyeebitlbW5SyYWa8EOGzIcYjcHjmyVYFlt6ux7zShqFh4acOPrJYSS5Qlz/+J3pX9vBiLKCienLnASC/pdSy9EVR2NsOKqvcEdb+4ntVi29szqhMI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=MDnXoG6s; arc=none smtp.client-ip=209.85.128.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MDnXoG6s" Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-48374014a77so712335e9.3 for ; Wed, 08 Apr 2026 10:23:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775668991; x=1776273791; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=jREm3HFme3aVGJIP/EKemib9zPX7Q4KblusWy7oLiOI=; b=MDnXoG6sQqaWch3kre5PaqbJYKnlAVCdYH5nb3iKptuP0oVlZyGLpV4zCtVzF8/JhU 5w7XKyTHJrLzmbK9Kbg93nkPd0UZ8fPK7iy+AXFbhuSj1/csiC0LepP/r2rN/cCNXDQI sXVfDp7QQFptqHIC7yVI6hL1PhDo3Pc2jpDkA83mUtrms5tyMF2hyjNFppEEjWMG4Kes ZiT7YGoYxdKMsXgnQhgrC3qzVz8dSlfp4jp/R36eFOm30NJD/lWBcM3DSAmhXXXkNqzR YQpiNdrX2SuIgBzAAJExezMkD8AiN6U75J3P2EcuEK48QTr9iBwVm0xGt3Pr39KqC7kt oXog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775668991; x=1776273791; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=jREm3HFme3aVGJIP/EKemib9zPX7Q4KblusWy7oLiOI=; b=NLjr6RNeS4oAJQBZJf3qz4wWVpv3bQs/RotsHlMRbiE5YRn8cDzx7NbSJrKn0HF/IB m05w4aV8LrGTXxX4hKg+hQrTgadJQe3XI+K/gfex4q3R845tv0O2BrkNjetjLnN+WU71 AXWooazFLzv19sIYR9g7Gw/EsUHcrwHKTDMBg9vNefZNLuQFVk59AD2CJB7TMUaEU+U4 R5MUKdKwJU+XAjX8BI0ggGZkUvMXPhBCEZZVm8pPD8WJ8XZzWLEP+LWPW2j/iNu4s6R1 uA+BKJZ3Aig2KrpRKuOkXk4TvgGF8R+PIm+HZ/8mU2JSFckdpznYF23WfoKgehs//LOx MEJA== X-Forwarded-Encrypted: i=1; AJvYcCUsSZvaYtS2B1sbT3Za9Jv7nxJlg2dapa/yxHqN6An6cxiyS2QXTrKAuk5LDqYhoXiD3ahFym7ojV2rdJ8=@vger.kernel.org X-Gm-Message-State: AOJu0YxpFU4MjCs/6v+rsT1wYD+tr3z6BVtOBZdF85WKvSKQfDz3D898 T5FTmD9H6Xqm5thTYODLLwDlltZAUP0rAwn6fh5+c+K9v3WHOCycIdQNtlyboauT2Mv9Gg== X-Gm-Gg: AeBDies75M75Zw5YIbazgi97IMyCZ3+VPWIMqFBfcTVz9agptswua1aIB6aX+M9kbmr prnCQrderlahQpxgB3BoHVDu/fvAjFxJdFsYhigtxOgxC+MtWTSCpQK9qgng+ab3C9OVGGP8P7Y UXPui2Jdg3qq9F7CkFgP45BhJuXdD6OIaEdMPhsUGH6ayFMhhqKE30MAzG/DRDvtVAlxjZpDhJx CXopgaUzbgXpj+H/fOqVpPtr3k9ypO012ar2NFZPwKwLLdgsigz4YRw/zAG8/m/fsVs5PSaGtpg U2cK8MIvgWk6nEkU3kIXmALolWUxm9rALmSuPg/7E73sDoxFjGvMaWCdPfFGOLgcKsgJGnHPrjY leE+z7Xuyjepg7ieeY7csloiysrmXkpL+e0n0ZsVyuPvquacW4t4/F34y6gXI7Kt9KmuW8IfPCa dqQHPwR9IjvkIJmw17NPoZtFNXBiIDptGZi5y4OfxFE1/bBBWzl59GlhWelF04rIiKbjeteWB4y rNRpJo+Dxvc X-Received: by 2002:a05:600c:3544:b0:485:303b:c50a with SMTP id 5b1f17b1804b1-488997352d3mr302107245e9.13.1775668990796; Wed, 08 Apr 2026 10:23:10 -0700 (PDT) Received: from dohko.chello.ie (188-141-5-72.dynamic.upc.ie. [188.141.5.72]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-488cd1d647fsm7015175e9.14.2026.04.08.10.23.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Apr 2026 10:23:10 -0700 (PDT) From: David Carlier To: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, horms@kernel.org Cc: sdf@fomichev.me, kuniyu@google.com, skhawaja@google.com, liuhangbin@gmail.com, krikku@gmail.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, David Carlier Subject: [PATCH] net: check qdisc_pkt_len_segs_init() return value on ingress Date: Wed, 8 Apr 2026 18:23:07 +0100 Message-ID: <20260408172307.172736-1-devnexen@gmail.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Commit 7fb4c1967011 ("net: pull headers in qdisc_pkt_len_segs_init()") changed qdisc_pkt_len_segs_init() to return an skb drop reason when it detects malicious GSO packets. The egress path in __dev_queue_xmit() checks this return value and drops bad packets, but the ingress path in sch_handle_ingress() ignores it. This means malformed GSO packets entering via TC ingress are not dropped and could be redirected to another interface or cause incorrect qdisc accounting. Check the return value and drop the packet when a bad GSO is detected. Fixes: 7fb4c1967011 ("net: pull headers in qdisc_pkt_len_segs_init()") Signed-off-by: David Carlier --- net/core/dev.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index 5a31f9d2128c..2b5f508fc479 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -4459,7 +4459,7 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret, struct net_device *orig_dev, bool *another) { struct bpf_mprog_entry *entry = rcu_dereference_bh(skb->dev->tcx_ingress); - enum skb_drop_reason drop_reason = SKB_DROP_REASON_TC_INGRESS; + enum skb_drop_reason drop_reason; struct bpf_net_context __bpf_net_ctx, *bpf_net_ctx; int sch_ret; @@ -4472,7 +4472,15 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret, *pt_prev = NULL; } - qdisc_pkt_len_segs_init(skb); + drop_reason = qdisc_pkt_len_segs_init(skb); + if (unlikely(drop_reason)) { + kfree_skb_reason(skb, drop_reason); + *ret = NET_RX_DROP; + bpf_net_ctx_clear(bpf_net_ctx); + return NULL; + } + + drop_reason = SKB_DROP_REASON_TC_INGRESS; tcx_set_ingress(skb, true); if (static_branch_unlikely(&tcx_needed_key)) { -- 2.53.0