This is a note to let you know that I've just added the patch titled net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 to the 5.11-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-avoid-infinite-loop-in-mpls_gso_segment-when-mpls_hlen-0.patch and it can be found in the queue-5.11 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From d348ede32e99d3a04863e9f9b28d224456118c27 Mon Sep 17 00:00:00 2001 From: Balazs Nemeth <bnemeth@xxxxxxxxxx> Date: Tue, 9 Mar 2021 12:31:01 +0100 Subject: net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 From: Balazs Nemeth <bnemeth@xxxxxxxxxx> commit d348ede32e99d3a04863e9f9b28d224456118c27 upstream. A packet with skb_inner_network_header(skb) == skb_network_header(skb) and ETH_P_MPLS_UC will prevent mpls_gso_segment from pulling any headers from the packet. Subsequently, the call to skb_mac_gso_segment will again call mpls_gso_segment with the same packet leading to an infinite loop. In addition, ensure that the header length is a multiple of four, which should hold irrespective of the number of stacked labels. Signed-off-by: Balazs Nemeth <bnemeth@xxxxxxxxxx> Acked-by: Willem de Bruijn <willemb@xxxxxxxxxx> Reviewed-by: David Ahern <dsahern@xxxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/mpls/mpls_gso.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/mpls/mpls_gso.c +++ b/net/mpls/mpls_gso.c @@ -14,6 +14,7 @@ #include <linux/netdev_features.h> #include <linux/netdevice.h> #include <linux/skbuff.h> +#include <net/mpls.h> static struct sk_buff *mpls_gso_segment(struct sk_buff *skb, netdev_features_t features) @@ -27,6 +28,8 @@ static struct sk_buff *mpls_gso_segment( skb_reset_network_header(skb); mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb); + if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN)) + goto out; if (unlikely(!pskb_may_pull(skb, mpls_hlen))) goto out; Patches currently in stable-queue which might be from bnemeth@xxxxxxxxxx are queue-5.11/net-avoid-infinite-loop-in-mpls_gso_segment-when-mpls_hlen-0.patch queue-5.11/net-check-if-protocol-extracted-by-virtio_net_hdr_set_proto-is-correct.patch