diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-04-04 01:15:40 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-04-08 05:02:13 +0300 |
| commit | 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 (patch) | |
| tree | 48975e0807d9dea713a664008e159052ca6eba3c /include/net | |
| parent | 30e02ec3b4b6bd429a4824f125eb843a291dcccf (diff) | |
| download | linux-7fb4c19670110f052c04e1ec1d2b953b9f4f57e4.tar.xz | |
net: pull headers in qdisc_pkt_len_segs_init()
Most ndo_start_xmit() methods expects headers of gso packets
to be already in skb->head.
net/core/tso.c users are particularly at risk, because tso_build_hdr()
does a memcpy(hdr, skb->data, hdr_len);
qdisc_pkt_len_segs_init() already does a dissection of gso packets.
Use pskb_may_pull() instead of skb_header_pointer() to make
sure drivers do not have to reimplement this.
Some malicious packets could be fed, detect them so that we can
drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason.
Fixes: e876f208af18 ("net: Add a software TSO helper API")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Joe Damato <joe@dama.to>
Link: https://patch.msgid.link/20260403221540.3297753-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/net')
| -rw-r--r-- | include/net/dropreason-core.h | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/include/net/dropreason-core.h b/include/net/dropreason-core.h index de61dd5dbfd9..51855de5d208 100644 --- a/include/net/dropreason-core.h +++ b/include/net/dropreason-core.h @@ -74,6 +74,7 @@ FN(UNHANDLED_PROTO) \ FN(SKB_CSUM) \ FN(SKB_GSO_SEG) \ + FN(SKB_BAD_GSO) \ FN(SKB_UCOPY_FAULT) \ FN(DEV_HDR) \ FN(DEV_READY) \ @@ -392,6 +393,8 @@ enum skb_drop_reason { SKB_DROP_REASON_SKB_CSUM, /** @SKB_DROP_REASON_SKB_GSO_SEG: gso segmentation error */ SKB_DROP_REASON_SKB_GSO_SEG, + /** @SKB_DROP_REASON_SKB_BAD_GSO: malicious gso packet. */ + SKB_DROP_REASON_SKB_BAD_GSO, /** * @SKB_DROP_REASON_SKB_UCOPY_FAULT: failed to copy data from user space, * e.g., via zerocopy_sg_from_iter() or skb_orphan_frags_rx() |