Patch "ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL" has been added to the 4.4-stable tree

Patch "ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ipv4-only-create-late-gso-skb-if-skb-is-already-set-up-with-checksum_partial.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From foo@baz Sat Apr 16 10:02:52 PDT 2016
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Mon, 22 Feb 2016 18:43:25 +0100
Subject: ipv4: only create late gso-skb if skb is already set up with CHECKSUM_PARTIAL

From: Hannes Frederic Sowa <hannes@stressinduktion.org>

[ Upstream commit a8c4a2522a0808c5c2143612909717d1115c40cf ]

Otherwise we break the contract with GSO to only pass CHECKSUM_PARTIAL
skbs down. This can easily happen with UDP+IPv4 sockets with the first
MSG_MORE write smaller than the MTU, second write is a sendfile.

Returning -EOPNOTSUPP lets the callers fall back into normal sendmsg path,
were we calculate the checksum manually during copying.

Commit d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked
sockets") started to exposes this bug.

Fixes: d749c9cbffd6 ("ipv4: no CHECKSUM_PARTIAL on MSG_MORE corked sockets")
Reported-by: Jiri Benc <jbenc@redhat.com>
Cc: Jiri Benc <jbenc@redhat.com>
Reported-by: Wakko Warner <wakko@animx.eu.org>
Cc: Wakko Warner <wakko@animx.eu.org>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 net/ipv4/ip_output.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1237,13 +1237,16 @@ ssize_t	ip_append_page(struct sock *sk,
 	if (!skb)
 		return -EINVAL;
 
-	cork->length += size;
 	if ((size + skb->len > mtu) &&
 	    (sk->sk_protocol == IPPROTO_UDP) &&
 	    (rt->dst.dev->features & NETIF_F_UFO)) {
+		if (skb->ip_summed != CHECKSUM_PARTIAL)
+			return -EOPNOTSUPP;
+
 		skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
 		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
 	}
+	cork->length += size;
 
 	while (size > 0) {
 		if (skb_is_gso(skb)) {


Patches currently in stable-queue which might be from hannes@stressinduktion.org are

queue-4.4/ipv4-fix-broadcast-packets-reception.patch
queue-4.4/ipv4-only-create-late-gso-skb-if-skb-is-already-set-up-with-checksum_partial.patch
queue-4.4/ipv6-count-in-extension-headers-in-skb-network_header.patch
queue-4.4/mld-igmp-fix-reserved-tailroom-calculation.patch