When assembling fraglist GSO packets, udp4_gro_complete does not set
skb->csum_start, which makes the extra validation in __udp_gso_segment fail.

Fixes: 89add40066f9 ("net: drop bad gso csum_start and offset in virtio_net_hdr")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 net/ipv4/udp_offload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index b254a5dadfcf..d842303587af 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -279,7 +279,8 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
 		return ERR_PTR(-EINVAL);
 
 	if (unlikely(skb_checksum_start(gso_skb) !=
-		     skb_transport_header(gso_skb)))
+		     skb_transport_header(gso_skb) &&
+		     !(skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)))
 		return ERR_PTR(-EINVAL);
 
 	/* We don't know if egress device can segment and checksum the packet
-- 
2.46.0

Felix Fietkau wrote:
> When assembling fraglist GSO packets, udp4_gro_complete does not set
> skb->csum_start, which makes the extra validation in __udp_gso_segment fail.
> 
> Fixes: 89add40066f9 ("net: drop bad gso csum_start and offset in virtio_net_hdr")
> Signed-off-by: Felix Fietkau <nbd@nbd.name>

Reviewed-by: Willem de Bruijn <willemb@google.com>

Oh right, UDP GRO fraglist skbs are converted to CHECKSUM_UNNECSSARY
with __skb_incr_checksum_unnecessary.

Rather than to CHECKSUM_PARTIAL, as udp_gro_complete_segment does for
non fraglist GRO packets.

virtio_net_hdr_to_skb cannot generate fraglist packets, so this bad
input check is unnecessary for SKB_GSO_FRAGLIST too.

Thanks for the fix, Felix.