[PATCH v5] net: gro: fix double aggregation of flush-marked skbs

[PATCH v5] net: gro: fix double aggregation of flush-marked skbs

[Shiming Cheng]

The skb_gro_receive_list() function is missing a critical safety check
that exists in the skb_gro_receive() implementation. Specifically, it
does not validate NAPI_GRO_CB(skb)->flush before allowing packet
aggregation

This allows already-GRO'd packets with existing frag_list to be
re-aggregated into a new GRO session, corrupting the frag_list chain
structure. When skb_segment() attempts to unpack these malformed packets,
it encounters invalid state and triggers a kernel panic.

Scenario (Tethering/Device forwarding):
  1. Driver: Generated aggregated packet P1 via LRO with frag_list
  2. Dev A: Receives aggregated fraglist packet and flush flag set
  3. Dev A: Re-enters GRO, skb_gro_receive_list() is called
  4. Missing flush check allows re-aggregation despite flush flag
  5. Frag_list chain becomes corrupted (loops or dangling refs)
  6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list

Root cause in skb_segment():
  The check at line ~4891:
    if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) &&
        (skb_headlen(list_skb) == len || sg)) {

  When frag_list is corrupted by double aggregation, when list_skb is
  a NULL pointer from skb->next, skb_headlen(list_skb) dereference
  NULL/corrupted pointers occurs.

Call Trace:
 skb_headlen(NULL skb)
 skb_segment
 tcp_gso_segment
 tcp4_gso_segment
 inet_gso_segment
 skb_mac_gso_segment
 __skb_gso_segment
 skb_gso_segment
 validate_xmit_skb
 validate_xmit_skb_list
 sch_direct_xmit
 qdisc_restart
 __qdisc_run
 qdisc_run
 net_tx_action

Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in
skb_gro_receive_list(), matching the defensive programming pattern of
skb_gro_receive().

Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
Cc: stable@vger.kernel.org
Signed-off-by: Shiming Cheng <shiming.cheng@mediatek.com>
---
 net/core/gro.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/net/core/gro.c b/net/core/gro.c
index 35f2f708f010..b1573d98f3a5 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -229,7 +229,14 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
 
 int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
 {
-	if (unlikely(p->len + skb->len >= 65536))
+	/*
+	 * Packets marked with NAPI_GRO_CB(skb)->flush have already gone
+	 * through GRO/LRO processing and must not be aggregated again.
+	 * Re-entering frag_list GRO may corrupt the frag_list chain and
+	 * later crash during GSO segmentaiont.
+	 */
+	if (unlikely(p->len + skb->len >= 65536 ||
+		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;
 
 	if (!pskb_may_pull(skb, skb_gro_offset(skb))) {
-- 
2.45.2

Re: [PATCH v5] net: gro: fix double aggregation of flush-marked skbs

[Willem de Bruijn]

[PATCH net v5]

Shiming Cheng wrote:
> The skb_gro_receive_list() function is missing a critical safety check
> that exists in the skb_gro_receive() implementation. Specifically, it
> does not validate NAPI_GRO_CB(skb)->flush before allowing packet
> aggregation

In v3 I requested referring to the commit that fixed this in
skb_gro_receive: commit 0ab03f353d36 ("net-gro: Fix GRO flush when
receiving a GSO packet."). That explains the issue well.
> 
> This allows already-GRO'd packets with existing frag_list to be
> re-aggregated into a new GRO session, corrupting the frag_list chain
> structure. When skb_segment() attempts to unpack these malformed packets,
> it encounters invalid state and triggers a kernel panic.
> 
> Scenario (Tethering/Device forwarding):
>   1. Driver: Generated aggregated packet P1 via LRO with frag_list
>   2. Dev A: Receives aggregated fraglist packet and flush flag set
>   3. Dev A: Re-enters GRO, skb_gro_receive_list() is called
>   4. Missing flush check allows re-aggregation despite flush flag
>   5. Frag_list chain becomes corrupted (loops or dangling refs)
>   6. Dev B: TX path calls skb_segment(), crashes on corrupted frag_list
> 
> Root cause in skb_segment():
>   The check at line ~4891:
>     if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) &&
>         (skb_headlen(list_skb) == len || sg)) {
> 
>   When frag_list is corrupted by double aggregation, when list_skb is
>   a NULL pointer from skb->next, skb_headlen(list_skb) dereference
>   NULL/corrupted pointers occurs.
> 
> Call Trace:
>  skb_headlen(NULL skb)
>  skb_segment
>  tcp_gso_segment
>  tcp4_gso_segment
>  inet_gso_segment
>  skb_mac_gso_segment
>  __skb_gso_segment
>  skb_gso_segment
>  validate_xmit_skb
>  validate_xmit_skb_list
>  sch_direct_xmit
>  qdisc_restart
>  __qdisc_run
>  qdisc_run
>  net_tx_action
> 
> Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return check in
> skb_gro_receive_list(), matching the defensive programming pattern of
> skb_gro_receive().
> 
> Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Shiming Cheng <shiming.cheng@mediatek.com>
> ---
>  net/core/gro.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/gro.c b/net/core/gro.c
> index 35f2f708f010..b1573d98f3a5 100644
> --- a/net/core/gro.c
> +++ b/net/core/gro.c
> @@ -229,7 +229,14 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
>  
>  int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
>  {
> -	if (unlikely(p->len + skb->len >= 65536))
> +	/*
> +	 * Packets marked with NAPI_GRO_CB(skb)->flush have already gone
> +	 * through GRO/LRO processing and must not be aggregated again.
> +	 * Re-entering frag_list GRO may corrupt the frag_list chain and
> +	 * later crash during GSO segmentaiont.
> +	 */

Such a verbose comment is not needed. Code would be overwhelmed by
comments if done everywhere.

> +	if (unlikely(p->len + skb->len >= 65536 ||
> +		     NAPI_GRO_CB(skb)->flush))
>  		return -E2BIG;
>  
>  	if (!pskb_may_pull(skb, skb_gro_offset(skb))) {
> -- 
> 2.45.2
> 

Re: [PATCH v5] net: gro: fix double aggregation of flush-marked skbs

[Shiming Cheng (成诗明)]

On Mon, 2026-07-06 at 12:36 -0400, Willem de Bruijn wrote:
> External email : Please do not click links or open attachments until
> you have verified the sender or the content.
> 
> 
> [PATCH net v5]
> 
> Shiming Cheng wrote:
> > The skb_gro_receive_list() function is missing a critical safety
> > check
> > that exists in the skb_gro_receive() implementation. Specifically,
> > it
> > does not validate NAPI_GRO_CB(skb)->flush before allowing packet
> > aggregation
> 
> In v3 I requested referring to the commit that fixed this in
> skb_gro_receive: commit 0ab03f353d36 ("net-gro: Fix GRO flush when
> receiving a GSO packet."). That explains the issue well.

updated in PATCH V6.

> > 
> > This allows already-GRO'd packets with existing frag_list to be
> > re-aggregated into a new GRO session, corrupting the frag_list
> > chain
> > structure. When skb_segment() attempts to unpack these malformed
> > packets,
> > it encounters invalid state and triggers a kernel panic.
> > 
> > Scenario (Tethering/Device forwarding):
> >   1. Driver: Generated aggregated packet P1 via LRO with frag_list
> >   2. Dev A: Receives aggregated fraglist packet and flush flag set
> >   3. Dev A: Re-enters GRO, skb_gro_receive_list() is called
> >   4. Missing flush check allows re-aggregation despite flush flag
> >   5. Frag_list chain becomes corrupted (loops or dangling refs)
> >   6. Dev B: TX path calls skb_segment(), crashes on corrupted
> > frag_list
> > 
> > Root cause in skb_segment():
> >   The check at line ~4891:
> >     if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) &&
> >         (skb_headlen(list_skb) == len || sg)) {
> > 
> >   When frag_list is corrupted by double aggregation, when list_skb
> > is
> >   a NULL pointer from skb->next, skb_headlen(list_skb) dereference
> >   NULL/corrupted pointers occurs.
> > 
> > Call Trace:
> >  skb_headlen(NULL skb)
> >  skb_segment
> >  tcp_gso_segment
> >  tcp4_gso_segment
> >  inet_gso_segment
> >  skb_mac_gso_segment
> >  __skb_gso_segment
> >  skb_gso_segment
> >  validate_xmit_skb
> >  validate_xmit_skb_list
> >  sch_direct_xmit
> >  qdisc_restart
> >  __qdisc_run
> >  qdisc_run
> >  net_tx_action
> > 
> > Fix: Add NAPI_GRO_CB(skb)->flush validation to the early-return
> > check in
> > skb_gro_receive_list(), matching the defensive programming pattern
> > of
> > skb_gro_receive().
> > 
> > Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Shiming Cheng <shiming.cheng@mediatek.com>
> > ---
> >  net/core/gro.c | 9 ++++++++-
> >  1 file changed, 8 insertions(+), 1 deletion(-)
> > 
> > diff --git a/net/core/gro.c b/net/core/gro.c
> > index 35f2f708f010..b1573d98f3a5 100644
> > --- a/net/core/gro.c
> > +++ b/net/core/gro.c
> > @@ -229,7 +229,14 @@ int skb_gro_receive(struct sk_buff *p, struct
> > sk_buff *skb)
> > 
> >  int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
> >  {
> > -     if (unlikely(p->len + skb->len >= 65536))
> > +     /*
> > +      * Packets marked with NAPI_GRO_CB(skb)->flush have already
> > gone
> > +      * through GRO/LRO processing and must not be aggregated
> > again.
> > +      * Re-entering frag_list GRO may corrupt the frag_list chain
> > and
> > +      * later crash during GSO segmentaiont.
> > +      */
> 
> Such a verbose comment is not needed. Code would be overwhelmed by
> comments if done everywhere.
> 

updated comment in PATCH V6.

> > +     if (unlikely(p->len + skb->len >= 65536 ||
> > +                  NAPI_GRO_CB(skb)->flush))
> >               return -E2BIG;
> > 
> >       if (!pskb_may_pull(skb, skb_gro_offset(skb))) {
> > --
> > 2.45.2
> > 
> 
>