This is a note to let you know that I've just added the patch titled udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments to the 5.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: udp-fix-the-proto-value-passed-to-ip_protocol_deliver_rcu-for-the-segments.patch and it can be found in the queue-5.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Sat Dec 19 11:38:43 AM CET 2020 From: Xin Long <lucien.xin@xxxxxxxxx> Date: Mon, 7 Dec 2020 15:55:40 +0800 Subject: udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments From: Xin Long <lucien.xin@xxxxxxxxx> [ Upstream commit 10c678bd0a035ac2c64a9b26b222f20556227a53 ] Guillaume noticed that: for segments udp_queue_rcv_one_skb() returns the proto, and it should pass "ret" unmodified to ip_protocol_deliver_rcu(). Otherwize, with a negtive value passed, it will underflow inet_protos. This can be reproduced with IPIP FOU: # ip fou add port 5555 ipproto 4 # ethtool -K eth1 rx-gro-list on Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") Reported-by: Guillaume Nault <gnault@xxxxxxxxxx> Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/ipv4/udp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -2173,7 +2173,7 @@ static int udp_queue_rcv_skb(struct sock __skb_pull(skb, skb_transport_offset(skb)); ret = udp_queue_rcv_one_skb(sk, skb); if (ret > 0) - ip_protocol_deliver_rcu(dev_net(skb->dev), skb, -ret); + ip_protocol_deliver_rcu(dev_net(skb->dev), skb, ret); } return 0; } Patches currently in stable-queue which might be from lucien.xin@xxxxxxxxx are queue-5.9/udp-fix-the-proto-value-passed-to-ip_protocol_deliver_rcu-for-the-segments.patch