diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2026-08-27 15:47:19 +0200 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-08-27 15:47:19 +0200 |
| commit | 81eb1867e059bf1dbbfbba536385a5cb26f700cd (patch) | |
| tree | f6d28ba20e028279fdc90a8a15b1104986673244 | |
| parent | 2c4e7c42d77e78ad595dbb9e4b5886b58b45d89d (diff) | |
| parent | 0b13256ce37b66dbd0e4ce78d5bee32fd38db1a5 (diff) | |
| download | linux-81eb1867e059bf1dbbfbba536385a5cb26f700cd.tar.gz linux-81eb1867e059bf1dbbfbba536385a5cb26f700cd.zip | |
Merge branch 'guard-against-gso_segs-overflows'
Alice Mikityanska says:
====================
Guard against gso_segs overflows
This series is a follow-up on the discussion:
https://lore.kernel.org/netdev/CAD0BsJWzSr2zduf5v3mVC4zd=Lj6ZAoC+V42-VBdg42aDY8XXw@mail.gmail.com/T/#m1e22fca273c36cc8844e516505d3251cc1418fea
skb_segment is patched to avoid possible overflows in partial GSO. The
primary possible source of too many GSO segments is also addressed:
virtio-net clamps gso_size to >=8 in TCP, as suggested by Eric.
v2: https://lore.kernel.org/netdev/20260813174613.2920246-1-alice.kernel@fastmail.im/
v1: https://lore.kernel.org/netdev/20260723155145.158572-1-alice.kernel@fastmail.im/
====================
Link: https://patch.msgid.link/20260822120117.1163423-1-alice.kernel@fastmail.im
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
| -rw-r--r-- | include/linux/virtio_net.h | 4 | ||||
| -rw-r--r-- | net/core/skbuff.c | 3 |
2 files changed, 6 insertions, 1 deletions
diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h index f36d21b5bc19..c381b916c1b5 100644 --- a/include/linux/virtio_net.h +++ b/include/linux/virtio_net.h @@ -6,6 +6,7 @@ #include <linux/ip.h> #include <linux/ipv6.h> #include <linux/udp.h> +#include <net/tcp.h> #include <uapi/linux/tcp.h> #include <uapi/linux/virtio_net.h> @@ -179,6 +180,9 @@ retry: if (skb->ip_summed == CHECKSUM_PARTIAL && skb->csum_offset != offsetof(struct tcphdr, check)) return -EINVAL; + + BUILD_BUG_ON(TCP_MIN_GSO_SIZE * GSO_MAX_SEGS < GSO_MAX_SIZE); + gso_size = max(gso_size, TCP_MIN_GSO_SIZE); break; } diff --git a/net/core/skbuff.c b/net/core/skbuff.c index cbbd60455abb..966af3beed94 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -4873,7 +4873,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, * doesn't fit into an MSS sized block, so take care of that * now. */ - partial_segs = len / mss; + DEBUG_NET_WARN_ON_ONCE(len / mss > GSO_MAX_SEGS); + partial_segs = min(len / mss, GSO_MAX_SEGS); if (partial_segs > 1) mss *= partial_segs; else |