Commit ca07e43e authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: gro: fix a potential crash in skb_gro_reset_offset 



Before accessing skb first fragment, better make sure there
is one.

This is probably not needed for old kernels, since an ethernet frame
cannot contain only an ethernet header, but the recent GRO addition
to tunnels makes this patch needed.

Also skb_gro_reset_offset() can be static, it actually allows
compiler to inline it.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 51ec0403

include/linux/netdevice.h

+0 −1
Original line number Diff line number Diff line
@@ -1663,7 +1663,6 @@ extern int netpoll_trap(void); 
#endif

extern int	       skb_gro_receive(struct sk_buff **head,

				       struct sk_buff *skb);

extern void	       skb_gro_reset_offset(struct sk_buff *skb);



static inline unsigned int skb_gro_offset(const struct sk_buff *skb)

{

net/core/dev.c

+8 −6
Original line number Diff line number Diff line
@@ -3631,20 +3631,22 @@ gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb) 
}

EXPORT_SYMBOL(napi_skb_finish);



void skb_gro_reset_offset(struct sk_buff *skb)

static void skb_gro_reset_offset(struct sk_buff *skb)

{

	const struct skb_shared_info *pinfo = skb_shinfo(skb);

	const skb_frag_t *frag0 = &pinfo->frags[0];



	NAPI_GRO_CB(skb)->data_offset = 0;

	NAPI_GRO_CB(skb)->frag0 = NULL;

	NAPI_GRO_CB(skb)->frag0_len = 0;



	if (skb->mac_header == skb->tail &&

	    !PageHighMem(skb_frag_page(&skb_shinfo(skb)->frags[0]))) {

		NAPI_GRO_CB(skb)->frag0 =

			skb_frag_address(&skb_shinfo(skb)->frags[0]);

		NAPI_GRO_CB(skb)->frag0_len = skb_frag_size(&skb_shinfo(skb)->frags[0]);

	    pinfo->nr_frags &&

	    !PageHighMem(skb_frag_page(frag0))) {

		NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);

		NAPI_GRO_CB(skb)->frag0_len = skb_frag_size(frag0);

	}

}

EXPORT_SYMBOL(skb_gro_reset_offset);



gro_result_t napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)

{

CRA Git | Maintained and supported by SUSTech CRA and CCSE