diff options
| author | Mark Brown <broonie@kernel.org> | 2024-10-29 14:33:54 +0000 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2024-10-29 14:33:54 +0000 |
| commit | 336f0fbf510880f7b2f9ea7e473fefc02222070c (patch) | |
| tree | 0c92b6c9f51d68f1260063a9a2175f314d5de09b /net/core/dev.c | |
| parent | caf78b0465053c23aa6211b9815dd5433766627d (diff) | |
| parent | 8e929cb546ee42c9a61d24fae60605e9e3192354 (diff) | |
regmap: Merge up fixes from v6.12-rc3
For the benefit of CI.
Diffstat (limited to 'net/core/dev.c')
| -rw-r--r-- | net/core/dev.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index cd479f5f22f6..ea5fbcd133ae 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3512,7 +3512,7 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb, if (gso_segs > READ_ONCE(dev->gso_max_segs)) return features & ~NETIF_F_GSO_MASK; - if (unlikely(skb->len >= READ_ONCE(dev->gso_max_size))) + if (unlikely(skb->len >= netif_get_gso_max_size(dev, skb))) return features & ~NETIF_F_GSO_MASK; if (!skb_shinfo(skb)->gso_type) { @@ -3758,7 +3758,7 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) sizeof(_tcphdr), &_tcphdr); if (likely(th)) hdr_len += __tcp_hdrlen(th); - } else { + } else if (shinfo->gso_type & SKB_GSO_UDP_L4) { struct udphdr _udphdr; if (skb_header_pointer(skb, hdr_len, @@ -3766,10 +3766,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len += sizeof(struct udphdr); } - if (shinfo->gso_type & SKB_GSO_DODGY) - gso_segs = DIV_ROUND_UP(skb->len - hdr_len, - shinfo->gso_size); + if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) { + int payload = skb->len - hdr_len; + /* Malicious packet. */ + if (payload <= 0) + return; + gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size); + } qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; } } |