[PATCH net-next 3/3] net: Limit to GSO_MAX_SEGS in skb_gro_receive

[Alice Mikityanska <alice.kernel@fastmail.im>]

From: Alice Mikityanska <alice@isovalent.com>

NAPI_GRO_CB(skb)->count is a 16-bit field used during GRO aggregation,
which gets assigned to skb_shinfo(skb)->gso_segs upon GRO completion.
While doing GRO aggregation in skb_gro_receive, make sure we don't
overflow this field.

Subtraction is intentional to avoid overflow.

Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Assisted-by: Codex:GPT-5.6
---
 net/core/gro.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/gro.c b/net/core/gro.c
index 35f2f708f010..1a9d2a4f9a80 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -126,6 +126,9 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
 	lp = NAPI_GRO_CB(p)->last;
 	pinfo = skb_shinfo(lp);
 
+	if (unlikely(segs > GSO_MAX_SEGS - NAPI_GRO_CB(p)->count))
+		return -E2BIG;
+
 	if (headlen <= offset) {
 		skb_frag_t *frag;
 		skb_frag_t *frag2;
-- 
2.55.0