Commit de843723 authored by Tom Herbert's avatar Tom Herbert Committed by David S. Miller

net: fix setting csum_start in skb_segment()

Dave Jones reported that a crash is occurring in

csum_partial
tcp_gso_segment
inet_gso_segment
? update_dl_migration
skb_mac_gso_segment
__skb_gso_segment
dev_hard_start_xmit
sch_direct_xmit
__dev_queue_xmit
? dev_hard_start_xmit
dev_queue_xmit
ip_finish_output
? ip_output
ip_output
ip_forward_finish
ip_forward
ip_rcv_finish
ip_rcv
__netif_receive_skb_core
? __netif_receive_skb_core
? trace_hardirqs_on
__netif_receive_skb
netif_receive_skb_internal
napi_gro_complete
? napi_gro_complete
dev_gro_receive
? dev_gro_receive
napi_gro_receive

It looks like a likely culprit is that SKB_GSO_CB()->csum_start is
not set correctly when doing non-scatter gather. We are using
offset as opposed to doffset.
Reported-by: default avatarDave Jones <davej@redhat.com>
Tested-by: default avatarDave Jones <davej@redhat.com>
Signed-off-by: default avatarTom Herbert <therbert@google.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Fixes: 7e2b10c1 ("net: Support for multiple checksums with gso")
Acked-by: default avatarTom Herbert <therbert@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f8864972
...@@ -2993,7 +2993,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, ...@@ -2993,7 +2993,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
skb_put(nskb, len), skb_put(nskb, len),
len, 0); len, 0);
SKB_GSO_CB(nskb)->csum_start = SKB_GSO_CB(nskb)->csum_start =
skb_headroom(nskb) + offset; skb_headroom(nskb) + doffset;
continue; continue;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment