Patch "gve: fix frag_list chaining" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    gve: fix frag_list chaining

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     gve-fix-frag_list-chaining.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 45f15f6e1de0334918eec4de6eb28f68ac122778
Author: Eric Dumazet <edumazet@xxxxxxxxxx>
Date:   Thu Aug 31 21:38:12 2023 +0000

    gve: fix frag_list chaining
    
    [ Upstream commit 817c7cd2043a83a3d8147f40eea1505ac7300b62 ]
    
    gve_rx_append_frags() is able to build skbs chained with frag_list,
    like GRO engine.
    
    Problem is that shinfo->frag_list should only be used
    for the head of the chain.
    
    All other links should use skb->next pointer.
    
    Otherwise, built skbs are not valid and can cause crashes.
    
    Equivalent code in GRO (skb_gro_receive()) is:
    
        if (NAPI_GRO_CB(p)->last == p)
            skb_shinfo(p)->frag_list = skb;
        else
            NAPI_GRO_CB(p)->last->next = skb;
        NAPI_GRO_CB(p)->last = skb;
    
    Fixes: 9b8dd5e5ea48 ("gve: DQO: Add RX path")
    Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Cc: Bailey Forrest <bcf@xxxxxxxxxx>
    Cc: Willem de Bruijn <willemb@xxxxxxxxxx>
    Cc: Catherine Sullivan <csully@xxxxxxxxxx>
    Reviewed-by: David Ahern <dsahern@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/google/gve/gve_rx_dqo.c b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
index 7b18b4fd9e548..fdfe4c6d230f4 100644
--- a/drivers/net/ethernet/google/gve/gve_rx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_rx_dqo.c
@@ -492,7 +492,10 @@ static int gve_rx_append_frags(struct napi_struct *napi,
 		if (!skb)
 			return -1;
 
-		skb_shinfo(rx->skb_tail)->frag_list = skb;
+		if (rx->ctx.skb_tail == rx->ctx.skb_head)
+			skb_shinfo(rx->ctx.skb_head)->frag_list = skb;
+		else
+			rx->ctx.skb_tail->next = skb;
 		rx->skb_tail = skb;
 		num_frags = 0;
 	}