Felix Fietkau wrote: > On 22.09.24 17:03, Willem de Bruijn wrote: > > From: Willem de Bruijn <willemb@xxxxxxxxxx> > > > > Detect gso fraglist skbs with corrupted geometry (see below) and > > pass these to skb_segment instead of skb_segment_list, as the first > > can segment them correctly. > > > > Valid SKB_GSO_FRAGLIST skbs > > - consist of two or more segments > > - the head_skb holds the protocol headers plus first gso_size > > - one or more frag_list skbs hold exactly one segment > > - all but the last must be gso_size > > > > Optional datapath hooks such as NAT and BPF (bpf_skb_pull_data) can > > modify these skbs, breaking these invariants. > > > > In extreme cases they pull all data into skb linear. For UDP, this > > causes a NULL ptr deref in __udpv4_gso_segment_list_csum at > > udp_hdr(seg->next)->dest. > > > > Detect invalid geometry due to pull, by checking head_skb size. > > Don't just drop, as this may blackhole a destination. Convert to be > > able to pass to regular skb_segment. > > > > Link: https://lore.kernel.org/netdev/20240428142913.18666-1-shiming.cheng@xxxxxxxxxxxx/ > > Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") > > Signed-off-by: Willem de Bruijn <willemb@xxxxxxxxxx> > > Cc: stable@xxxxxxxxxxxxxxx > > Reviewed-by: Felix Fietkau <nbd@xxxxxxxx> I will respin with initialization of uh->check
