diff options
author | Eric Dumazet <edumazet@google.com> | 2014-05-16 14:34:37 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2014-05-16 17:24:54 -0400 |
commit | 29e98242783ed3ba569797846a606ba66f781625 (patch) | |
tree | 2d71da0d89ef9f62a4d244fc8d8a92d3f81a802c | |
parent | 22fb22eaebf4d16987f3fd9c3484c436ee0badf2 (diff) |
net: gro: make sure skb->cb[] initial content has not to be zero
Starting from linux-3.13, GRO attempts to build full size skbs.
Problem is the commit assumed one particular field in skb->cb[]
was clean, but it is not the case on some stacked devices.
Timo reported a crash in case traffic is decrypted before
reaching a GRE device.
Fix this by initializing NAPI_GRO_CB(skb)->last at the right place,
this also removes one conditional.
Thanks a lot to Timo for providing full reports and bisecting this.
Fixes: 8a29111c7ca6 ("net: gro: allow to build full sized skb")
Bisected-by: Timo Teras <timo.teras@iki.fi>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Timo Teräs <timo.teras@iki.fi>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | net/core/dev.c | 1 | ||||
-rw-r--r-- | net/core/skbuff.c | 4 |
2 files changed, 3 insertions, 2 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index 6da649bde4f7..ed928e846559 100644 --- a/net/core/dev.c +++ b/net/core/dev.c | |||
@@ -3951,6 +3951,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff | |||
3951 | } | 3951 | } |
3952 | NAPI_GRO_CB(skb)->count = 1; | 3952 | NAPI_GRO_CB(skb)->count = 1; |
3953 | NAPI_GRO_CB(skb)->age = jiffies; | 3953 | NAPI_GRO_CB(skb)->age = jiffies; |
3954 | NAPI_GRO_CB(skb)->last = skb; | ||
3954 | skb_shinfo(skb)->gso_size = skb_gro_len(skb); | 3955 | skb_shinfo(skb)->gso_size = skb_gro_len(skb); |
3955 | skb->next = napi->gro_list; | 3956 | skb->next = napi->gro_list; |
3956 | napi->gro_list = skb; | 3957 | napi->gro_list = skb; |
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 1b62343f5837..8383b2bddeb9 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c | |||
@@ -3076,7 +3076,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb) | |||
3076 | if (unlikely(p->len + len >= 65536)) | 3076 | if (unlikely(p->len + len >= 65536)) |
3077 | return -E2BIG; | 3077 | return -E2BIG; |
3078 | 3078 | ||
3079 | lp = NAPI_GRO_CB(p)->last ?: p; | 3079 | lp = NAPI_GRO_CB(p)->last; |
3080 | pinfo = skb_shinfo(lp); | 3080 | pinfo = skb_shinfo(lp); |
3081 | 3081 | ||
3082 | if (headlen <= offset) { | 3082 | if (headlen <= offset) { |
@@ -3192,7 +3192,7 @@ merge: | |||
3192 | 3192 | ||
3193 | __skb_pull(skb, offset); | 3193 | __skb_pull(skb, offset); |
3194 | 3194 | ||
3195 | if (!NAPI_GRO_CB(p)->last) | 3195 | if (NAPI_GRO_CB(p)->last == p) |
3196 | skb_shinfo(p)->frag_list = skb; | 3196 | skb_shinfo(p)->frag_list = skb; |
3197 | else | 3197 | else |
3198 | NAPI_GRO_CB(p)->last->next = skb; | 3198 | NAPI_GRO_CB(p)->last->next = skb; |