[PATCH net] net: gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()

[PATCH net] net: gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()

[Eric Dumazet]

Some network drivers assume this field is zero after napi_get_frags().

We must clear it in napi_reuse_skb() otherwise the following can happen:

1) A packet is received, and skb_shinfo(skb)->hwtstamps is populated
   because a bit in the receive descriptor announced hwtstamp
   availability for this packet.

2) Packet is given to gro layer via napi_gro_frags().

3) Packet is merged to a prior one held in GRO queues.

4) skb is saved after some cleanup in napi->skb via a call
   to napi_reuse_skb().

5) Next packet is received 10 seconds later, gets the recycled skb
   from napi_get_frags().

6) The receive descriptor does not announce hwtstamp availability.
   Driver does not clear shinfo->hwtstamps.

7) We have in shinfo->hwtstamps an old timestamp.

Fixes: ac45f602ee3d ("net: infrastructure for hardware time stamping")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 net/core/gro.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/net/core/gro.c b/net/core/gro.c
index 5ba4504cfd28ec26f487bfb96645e25c4845d720..76f9c3712422109ad00f15f6804abf6a8b00db43 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -639,6 +639,8 @@ EXPORT_SYMBOL(gro_receive_skb);
 
 static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 {
+	struct skb_shared_info *shinfo;
+
 	if (unlikely(skb->pfmemalloc)) {
 		consume_skb(skb);
 		return;
@@ -655,8 +657,12 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
 
 	skb->encapsulation = 0;
 	skb->ip_summed = CHECKSUM_NONE;
-	skb_shinfo(skb)->gso_type = 0;
-	skb_shinfo(skb)->gso_size = 0;
+
+	shinfo = skb_shinfo(skb);
+	shinfo->gso_type = 0;
+	shinfo->gso_size = 0;
+	shinfo->hwtstamps.hwtstamp = 0;
+
 	if (unlikely(skb->slow_gro)) {
 		skb_orphan(skb);
 		skb_ext_reset(skb);
-- 
2.51.0.788.g6d19910ace-goog

Re: [PATCH net] net: gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()

[Alexander Lobakin]

From: Eric Dumazet <edumazet@google.com>
Date: Wed, 15 Oct 2025 06:32:21 +0000

> Some network drivers assume this field is zero after napi_get_frags().
> 
> We must clear it in napi_reuse_skb() otherwise the following can happen:
> 
> 1) A packet is received, and skb_shinfo(skb)->hwtstamps is populated
>    because a bit in the receive descriptor announced hwtstamp
>    availability for this packet.
> 
> 2) Packet is given to gro layer via napi_gro_frags().
> 
> 3) Packet is merged to a prior one held in GRO queues.
> 
> 4) skb is saved after some cleanup in napi->skb via a call
>    to napi_reuse_skb().
> 
> 5) Next packet is received 10 seconds later, gets the recycled skb
>    from napi_get_frags().
> 
> 6) The receive descriptor does not announce hwtstamp availability.
>    Driver does not clear shinfo->hwtstamps.
> 
> 7) We have in shinfo->hwtstamps an old timestamp.
> 
> Fixes: ac45f602ee3d ("net: infrastructure for hardware time stamping")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>

Thanks,
Olek

Re: [PATCH net] net: gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 15 Oct 2025 06:32:21 +0000 you wrote:
> Some network drivers assume this field is zero after napi_get_frags().
> 
> We must clear it in napi_reuse_skb() otherwise the following can happen:
> 
> 1) A packet is received, and skb_shinfo(skb)->hwtstamps is populated
>    because a bit in the receive descriptor announced hwtstamp
>    availability for this packet.
> 
> [...]

Here is the summary with links:
  - [net] net: gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()
    https://git.kernel.org/netdev/net/c/d0d3e9c2867b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html