mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 12:52:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'guard-against-gso_segs-overflows'

Browse Source 
Alice Mikityanska says:

====================
Guard against gso_segs overflows

This series is a follow-up on the discussion:

https://lore.kernel.org/netdev/CAD0BsJWzSr2zduf5v3mVC4zd=Lj6ZAoC+V42-VBdg42aDY8XXw@mail.gmail.com/T/#m1e22fca273c36cc8844e516505d3251cc1418fea

skb_segment is patched to avoid possible overflows in partial GSO. The
primary possible source of too many GSO segments is also addressed:
virtio-net clamps gso_size to >=8 in TCP, as suggested by Eric.

v2: https://lore.kernel.org/netdev/20260813174613.2920246-1-alice.kernel@fastmail.im/
v1: https://lore.kernel.org/netdev/20260723155145.158572-1-alice.kernel@fastmail.im/
====================

Link: https://patch.msgid.link/20260822120117.1163423-1-alice.kernel@fastmail.im
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Paolo Abeni
2026-08-27 15:47:19 +02:00
parent 2c4e7c42d7 0b13256ce3
commit 81eb1867e0
2 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
include/linux/virtio_net.h
View File

@@ -6,6 +6,7 @@
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/udp.h>
#include <net/tcp.h>
#include <uapi/linux/tcp.h>
#include <uapi/linux/virtio_net.h>
@@ -179,6 +180,9 @@ static inline int __virtio_net_hdr_to_skb(struct sk_buff *skb,
if (skb->ip_summed == CHECKSUM_PARTIAL &&
skb->csum_offset != offsetof(struct tcphdr, check))
return -EINVAL;
BUILD_BUG_ON(TCP_MIN_GSO_SIZE * GSO_MAX_SEGS < GSO_MAX_SIZE);
gso_size = max(gso_size, TCP_MIN_GSO_SIZE);
break;
}

3
net/core/skbuff.c
View File

@@ -4873,7 +4873,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
* doesn't fit into an MSS sized block, so take care of that
* now.
*/
partial_segs = len / mss;
DEBUG_NET_WARN_ON_ONCE(len / mss > GSO_MAX_SEGS);
partial_segs = min(len / mss, GSO_MAX_SEGS);
if (partial_segs > 1)
mss *= partial_segs;
else