net: gro: avoid nesting GSO skbs in skb_gro_receive_list()

[PATCH net v1] net: gro: avoid nesting GSO skbs in skb_gro_receive_list()

Posted by zhaoping.shu@mediatek.com 2 days, 20 hours ago

From: HW He <hw.he@mediatek.com>

On devices that support both NETIF_F_GRO_HW and NETIF_F_GRO_FRAGLIST,
the hardware or driver may deliver packets that have already been
aggregated into a GSO skb, either with frags[] or frag_list. GRO may
then
aggregate the skb again in skb_gro_receive_list().

This can create a nested GSO skb, which is not handled correctly by the
later GSO segmentation paths. When the skb is segmented by
skb_segment_list(), it not be fully restored to the original packets.

If the skb is marked with SKB_GSO_DODGY before segmentation, for example
after a protocol change from IPv6 to IPv4, the nested GSO skb is
segmented
by skb_segment(), which may hit a NULL pointer dereference when the skb
contains a nested frag_list.

Avoid this by setting NAPI_GRO_CB(skb)->flush for GSO skbs before
aggregation and by checking the flush flag in skb_gro_receive_list(),
following the existing logic in skb_gro_receive().

Signed-off-by: HW He <hw.he@mediatek.com>
Signed-off-by: Zhaoping Shu <zhaoping.shu@mediatek.com>
---
 net/core/gro.c         | 2 +-
 net/ipv4/tcp_offload.c | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/gro.c b/net/core/gro.c
index 35f2f708f010..27c9813495f3 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -229,7 +229,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
 
 int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
 {
-	if (unlikely(p->len + skb->len >= 65536))
+	if (unlikely(p->len + skb->len >= 65536 || NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;
 
 	if (!pskb_may_pull(skb, skb_gro_offset(skb))) {
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index 3b1fdcd3cb29..c363434a5646 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -332,6 +332,7 @@ struct sk_buff *tcp_gro_receive(struct list_head *head, struct sk_buff *skb,
 		flush |= skb->ip_summed != p->ip_summed;
 		flush |= skb->csum_level != p->csum_level;
 		flush |= NAPI_GRO_CB(p)->count >= 64;
+		NAPI_GRO_CB(skb)->flush |= skb_is_gso(skb);
 		skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
 
 		if (flush || skb_gro_receive_list(p, skb))
-- 
2.17.0

Re: [PATCH net v1] net: gro: avoid nesting GSO skbs in skb_gro_receive_list()

Posted by Antoine Tenart 2 days, 15 hours ago

On Wed, Jul 22, 2026 at 10:42:14AM +0800, zhaoping.shu@mediatek.com wrote:
> From: HW He <hw.he@mediatek.com>
> 
> On devices that support both NETIF_F_GRO_HW and NETIF_F_GRO_FRAGLIST,
> the hardware or driver may deliver packets that have already been
> aggregated into a GSO skb, either with frags[] or frag_list. GRO may
> then
> aggregate the skb again in skb_gro_receive_list().
> 
> This can create a nested GSO skb, which is not handled correctly by the
> later GSO segmentation paths. When the skb is segmented by
> skb_segment_list(), it not be fully restored to the original packets.
> 
> If the skb is marked with SKB_GSO_DODGY before segmentation, for example
> after a protocol change from IPv6 to IPv4, the nested GSO skb is
> segmented
> by skb_segment(), which may hit a NULL pointer dereference when the skb
> contains a nested frag_list.
> 
> Avoid this by setting NAPI_GRO_CB(skb)->flush for GSO skbs before
> aggregation and by checking the flush flag in skb_gro_receive_list(),
> following the existing logic in skb_gro_receive().
> 
> Signed-off-by: HW He <hw.he@mediatek.com>
> Signed-off-by: Zhaoping Shu <zhaoping.shu@mediatek.com>
> ---
>  net/core/gro.c         | 2 +-
>  net/ipv4/tcp_offload.c | 1 +
>  2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/gro.c b/net/core/gro.c
> index 35f2f708f010..27c9813495f3 100644
> --- a/net/core/gro.c
> +++ b/net/core/gro.c
> @@ -229,7 +229,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
>  
>  int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
>  {
> -	if (unlikely(p->len + skb->len >= 65536))
> +	if (unlikely(p->len + skb->len >= 65536 || NAPI_GRO_CB(skb)->flush))
>  		return -E2BIG;

This was already fixed in e751256486d0 ("net: gro: fix double
aggregation of flush-marked skbs").
>  
>  	if (!pskb_may_pull(skb, skb_gro_offset(skb))) {
> diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
> index 3b1fdcd3cb29..c363434a5646 100644
> --- a/net/ipv4/tcp_offload.c
> +++ b/net/ipv4/tcp_offload.c
> @@ -332,6 +332,7 @@ struct sk_buff *tcp_gro_receive(struct list_head *head, struct sk_buff *skb,
>  		flush |= skb->ip_summed != p->ip_summed;
>  		flush |= skb->csum_level != p->csum_level;
>  		flush |= NAPI_GRO_CB(p)->count >= 64;
> +		NAPI_GRO_CB(skb)->flush |= skb_is_gso(skb);
>  		skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
>  
>  		if (flush || skb_gro_receive_list(p, skb))

I haven't looked closely but this looks like a second issue and would
need its own patch with a proper description.

Thanks,
Antoine