]> git.ipfire.org Git - thirdparty/openwrt.git/commit
kernel: drop redundant TCP fraglist GRO pull check 24524/head
authorJulius Bairaktaris <julius@bairaktaris.de>
Sat, 1 Aug 2026 22:20:35 +0000 (00:20 +0200)
committerJonas Jelonek <jelonek.jonas@gmail.com>
Tue, 4 Aug 2026 07:43:49 +0000 (09:43 +0200)
commit12a5e56a64224d79ef7f4bc8ee70ee69901be3ac
tree73acf46daa7a01b25b1e91026a5732350f234e19
parent2a837da774cbd2ca5c4bec47e5ffd114a1960b2a
kernel: drop redundant TCP fraglist GRO pull check

The patch adds a pre-check to tcp_gro_receive() so that an skb which
cannot be pulled up to the GRO offset is flushed instead of reaching the
BUG() in __skb_pull(). Upstream has since fixed the same bug inside the
callee, which leaves the pre-check with nothing to protect:

  commit f2bb3434544454099a5b6dec213567267b05d79d
  ("net: add pskb_may_pull() to skb_gro_receive_list()")

skb_gro_receive_list() now rejects the short skb itself and pulls with
skb_pull() rather than the __skb_pull() that carries the BUG(). It is
the only function the is_flist branch of tcp_gro_receive() calls, so no
path is left uncovered. The fix is present in both pinned kernels,
6.12.100 and 6.18.41.

Dropping the pre-check also restores upstream's intended handling: on
failure skb_gro_receive_list() sets NAPI_GRO_CB(skb)->flush, so the skb
is delivered through the normal receive path instead of being held as a
new GRO head. Short-circuiting on the local flush skipped that.

The patch keeps applying cleanly only because the fix landed in a
different function.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/24524
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
target/linux/generic/pending-6.12/690-net-add-missing-check-for-TCP-fraglist-GRO.patch [deleted file]
target/linux/generic/pending-6.18/690-net-add-missing-check-for-TCP-fraglist-GRO.patch [deleted file]