[PATCH net v1] net: gro: avoid nesting GSO skbs in skb_gro_receive_list()

From: HW He <redacted>

On devices that support both NETIF_F_GRO_HW and NETIF_F_GRO_FRAGLIST,
the hardware or driver may deliver packets that have already been
aggregated into a GSO skb, either with frags[] or frag_list. GRO may
then
aggregate the skb again in skb_gro_receive_list().

This can create a nested GSO skb, which is not handled correctly by the
later GSO segmentation paths. When the skb is segmented by
skb_segment_list(), it not be fully restored to the original packets.

If the skb is marked with SKB_GSO_DODGY before segmentation, for example
after a protocol change from IPv6 to IPv4, the nested GSO skb is
segmented
by skb_segment(), which may hit a NULL pointer dereference when the skb
contains a nested frag_list.

Avoid this by setting NAPI_GRO_CB(skb)->flush for GSO skbs before
aggregation and by checking the flush flag in skb_gro_receive_list(),
following the existing logic in skb_gro_receive().

Signed-off-by: HW He <redacted>
Signed-off-by: Zhaoping Shu <redacted>
---
 net/core/gro.c         | 2 +-
 net/ipv4/tcp_offload.c | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/gro.c b/net/core/gro.c
index 35f2f708f010..27c9813495f3 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c

@@ -229,7 +229,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
 
 int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
 {
-	if (unlikely(p->len + skb->len >= 65536))
+	if (unlikely(p->len + skb->len >= 65536 || NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;
 
 	if (!pskb_may_pull(skb, skb_gro_offset(skb))) {

diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index 3b1fdcd3cb29..c363434a5646 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c

@@ -332,6 +332,7 @@ struct sk_buff *tcp_gro_receive(struct list_head *head, struct sk_buff *skb,
 		flush |= skb->ip_summed != p->ip_summed;
 		flush |= skb->csum_level != p->csum_level;
 		flush |= NAPI_GRO_CB(p)->count >= 64;
+		NAPI_GRO_CB(skb)->flush |= skb_is_gso(skb);
 		skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
 
 		if (flush || skb_gro_receive_list(p, skb))

-- 
2.17.0