Patch "gve: ignore nonrelevant GSO type bits when processing TSO headers" has been added to the 6.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    gve: ignore nonrelevant GSO type bits when processing TSO headers

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     gve-ignore-nonrelevant-gso-type-bits-when-processing.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 06433658bafdaf20048c577f4df26dbf822860e8
Author: Joshua Washington <joshwash@xxxxxxxxxx>
Date:   Mon Jun 10 15:57:18 2024 -0700

    gve: ignore nonrelevant GSO type bits when processing TSO headers
    
    [ Upstream commit 1b9f756344416e02b41439bf2324b26aa25e141c ]
    
    TSO currently fails when the skb's gso_type field has more than one bit
    set.
    
    TSO packets can be passed from userspace using PF_PACKET, TUNTAP and a
    few others, using virtio_net_hdr (e.g., PACKET_VNET_HDR). This includes
    virtualization, such as QEMU, a real use-case.
    
    The gso_type and gso_size fields as passed from userspace in
    virtio_net_hdr are not trusted blindly by the kernel. It adds gso_type
    |= SKB_GSO_DODGY to force the packet to enter the software GSO stack
    for verification.
    
    This issue might similarly come up when the CWR bit is set in the TCP
    header for congestion control, causing the SKB_GSO_TCP_ECN gso_type bit
    to be set.
    
    Fixes: a57e5de476be ("gve: DQO: Add TX path")
    Signed-off-by: Joshua Washington <joshwash@xxxxxxxxxx>
    Reviewed-by: Praveen Kaligineedi <pkaligineedi@xxxxxxxxxx>
    Reviewed-by: Harshitha Ramamurthy <hramamurthy@xxxxxxxxxx>
    Reviewed-by: Willem de Bruijn <willemb@xxxxxxxxxx>
    Suggested-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Acked-by: Andrei Vagin <avagin@xxxxxxxxx>
    
    v2 - Remove unnecessary comments, remove line break between fixes tag
    and signoffs.
    
    v3 - Add back unrelated empty line removal.
    
    Link: https://lore.kernel.org/r/20240610225729.2985343-1-joshwash@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/google/gve/gve_tx_dqo.c b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
index bc34b6cd3a3e5..917a79a47e19c 100644
--- a/drivers/net/ethernet/google/gve/gve_tx_dqo.c
+++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c
@@ -555,28 +555,18 @@ static int gve_prep_tso(struct sk_buff *skb)
 	if (unlikely(skb_shinfo(skb)->gso_size < GVE_TX_MIN_TSO_MSS_DQO))
 		return -1;
 
+	if (!(skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+		return -EINVAL;
+
 	/* Needed because we will modify header. */
 	err = skb_cow_head(skb, 0);
 	if (err < 0)
 		return err;
 
 	tcp = tcp_hdr(skb);
-
-	/* Remove payload length from checksum. */
 	paylen = skb->len - skb_transport_offset(skb);
-
-	switch (skb_shinfo(skb)->gso_type) {
-	case SKB_GSO_TCPV4:
-	case SKB_GSO_TCPV6:
-		csum_replace_by_diff(&tcp->check,
-				     (__force __wsum)htonl(paylen));
-
-		/* Compute length of segmentation header. */
-		header_len = skb_tcp_all_headers(skb);
-		break;
-	default:
-		return -EINVAL;
-	}
+	csum_replace_by_diff(&tcp->check, (__force __wsum)htonl(paylen));
+	header_len = skb_tcp_all_headers(skb);
 
 	if (unlikely(header_len > GVE_TX_MAX_HDR_SIZE_DQO))
 		return -EINVAL;