kernel: drop redundant TCP fraglist GRO pull check

The patch adds a pre-check to tcp_gro_receive() so that an skb which
cannot be pulled up to the GRO offset is flushed instead of reaching the
BUG() in __skb_pull(). Upstream has since fixed the same bug inside the
callee, which leaves the pre-check with nothing to protect:

  commit f2bb3434544454099a5b6dec213567267b05d79d
  ("net: add pskb_may_pull() to skb_gro_receive_list()")

skb_gro_receive_list() now rejects the short skb itself and pulls with
skb_pull() rather than the __skb_pull() that carries the BUG(). It is
the only function the is_flist branch of tcp_gro_receive() calls, so no
path is left uncovered. The fix is present in both pinned kernels,
6.12.100 and 6.18.41.

Dropping the pre-check also restores upstream's intended handling: on
failure skb_gro_receive_list() sets NAPI_GRO_CB(skb)->flush, so the skb
is delivered through the normal receive path instead of being held as a
new GRO head. Short-circuiting on the local flush skipped that.

The patch keeps applying cleanly only because the fix landed in a
different function.

Assisted-by: Claude:claude-opus-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/24524
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>

diff --git a/target/linux/generic/pending-6.12/690-net-add-missing-check-for-TCP-fraglist-GRO.patch b/target/linux/generic/pending-6.12/690-net-add-missing-check-for-TCP-fraglist-GRO.patch
deleted file mode 100644 (file)
index 4684e04..0000000
--- a/target/linux/generic/pending-6.12/690-net-add-missing-check-for-TCP-fraglist-GRO.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 4498f0aa561092bc656bfabe7c4bdae41bc4a5b4 Mon Sep 17 00:00:00 2001
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 7 May 2024 11:24:50 +0200
-Subject: [PATCH] net: add missing check for TCP fraglist GRO
-
-It turns out that the existing checks do not guarantee that the skb can be
-pulled up to the GRO offset. When using the usb r8152 network driver with
-GRO fraglist, the BUG() in __skb_pull is often triggered.
-Fix the crash by adding the missing check.
-
-Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
- net/ipv4/tcp_offload.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/net/ipv4/tcp_offload.c
-+++ b/net/ipv4/tcp_offload.c
-@@ -355,6 +355,7 @@ struct sk_buff *tcp_gro_receive(struct l
-               flush |= (__force int)(flags ^ tcp_flag_word(th2));
-               flush |= skb->ip_summed != p->ip_summed;
-               flush |= skb->csum_level != p->csum_level;
-+              flush |= !pskb_may_pull(skb, skb_gro_offset(skb));
-               flush |= NAPI_GRO_CB(p)->count >= 64;
-               skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
- 

diff --git a/target/linux/generic/pending-6.18/690-net-add-missing-check-for-TCP-fraglist-GRO.patch b/target/linux/generic/pending-6.18/690-net-add-missing-check-for-TCP-fraglist-GRO.patch
deleted file mode 100644 (file)
index 9de4a60..0000000
--- a/target/linux/generic/pending-6.18/690-net-add-missing-check-for-TCP-fraglist-GRO.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 4498f0aa561092bc656bfabe7c4bdae41bc4a5b4 Mon Sep 17 00:00:00 2001
-From: Felix Fietkau <nbd@nbd.name>
-Date: Tue, 7 May 2024 11:24:50 +0200
-Subject: [PATCH] net: add missing check for TCP fraglist GRO
-
-It turns out that the existing checks do not guarantee that the skb can be
-pulled up to the GRO offset. When using the usb r8152 network driver with
-GRO fraglist, the BUG() in __skb_pull is often triggered.
-Fix the crash by adding the missing check.
-
-Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
- net/ipv4/tcp_offload.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/net/ipv4/tcp_offload.c
-+++ b/net/ipv4/tcp_offload.c
-@@ -359,6 +359,7 @@ struct sk_buff *tcp_gro_receive(struct l
-               flush |= (__force int)(flags ^ tcp_flag_word(th2));
-               flush |= skb->ip_summed != p->ip_summed;
-               flush |= skb->csum_level != p->csum_level;
-+              flush |= !pskb_may_pull(skb, skb_gro_offset(skb));
-               flush |= NAPI_GRO_CB(p)->count >= 64;
-               skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
-