[PATCH] udp_tunnel: avoid calling the wrong GRO handler

setup_udp_tunnel_sock() installs the GRO handlers before updating the
global static call. The socket is already bound, so packets can arrive
while the static call still points to the handler for another tunnel
type. Receive and completion can then parse the packet differently,
leading to OOB write.

Removing the static call is enough since the existing fallback already
calls the handler selected during setup through call_gro_receive_sk().
The helper also performs the same recursion check and sets the flush
flag when the limit is reached.

Fixes: 5d7f5b2f6b93 ("udp_tunnel: use static call for GRO hooks when possible")
Assisted-by: Codex:gpt-6
Signed-off-by: Jérémy Jean <redacted>
---
 net/ipv4/udp_offload.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index cf07c3c..30649f4 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c

@@ -148,13 +148,6 @@ static struct sk_buff *udp_tunnel_gro_rcv(struct sock *sk,
 					  struct list_head *head,
 					  struct sk_buff *skb)
 {
-	if (static_branch_likely(&udp_tunnel_static_call)) {
-		if (unlikely(gro_recursion_inc_test(skb))) {
-			NAPI_GRO_CB(skb)->flush |= 1;
-			return NULL;
-		}
-		return static_call(udp_tunnel_gro_rcv)(sk, head, skb);
-	}
 	return call_gro_receive_sk(udp_sk(sk)->gro_receive, sk, head, skb);
 }
 

-- 
2.47.3