From: Julius Bairaktaris Date: Sat, 1 Aug 2026 22:20:35 +0000 (+0200) Subject: kernel: drop redundant TCP fraglist GRO pull check X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F24524%2Fhead;p=thirdparty%2Fopenwrt.git kernel: drop redundant TCP fraglist GRO pull check The patch adds a pre-check to tcp_gro_receive() so that an skb which cannot be pulled up to the GRO offset is flushed instead of reaching the BUG() in __skb_pull(). Upstream has since fixed the same bug inside the callee, which leaves the pre-check with nothing to protect: commit f2bb3434544454099a5b6dec213567267b05d79d ("net: add pskb_may_pull() to skb_gro_receive_list()") skb_gro_receive_list() now rejects the short skb itself and pulls with skb_pull() rather than the __skb_pull() that carries the BUG(). It is the only function the is_flist branch of tcp_gro_receive() calls, so no path is left uncovered. The fix is present in both pinned kernels, 6.12.100 and 6.18.41. Dropping the pre-check also restores upstream's intended handling: on failure skb_gro_receive_list() sets NAPI_GRO_CB(skb)->flush, so the skb is delivered through the normal receive path instead of being held as a new GRO head. Short-circuiting on the local flush skipped that. The patch keeps applying cleanly only because the fix landed in a different function. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris Link: https://github.com/openwrt/openwrt/pull/24524 Signed-off-by: Jonas Jelonek --- diff --git a/target/linux/generic/pending-6.12/690-net-add-missing-check-for-TCP-fraglist-GRO.patch b/target/linux/generic/pending-6.12/690-net-add-missing-check-for-TCP-fraglist-GRO.patch deleted file mode 100644 index 4684e045d2d..00000000000 --- a/target/linux/generic/pending-6.12/690-net-add-missing-check-for-TCP-fraglist-GRO.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 4498f0aa561092bc656bfabe7c4bdae41bc4a5b4 Mon Sep 17 00:00:00 2001 -From: Felix Fietkau -Date: Tue, 7 May 2024 11:24:50 +0200 -Subject: [PATCH] net: add missing check for TCP fraglist GRO - -It turns out that the existing checks do not guarantee that the skb can be -pulled up to the GRO offset. When using the usb r8152 network driver with -GRO fraglist, the BUG() in __skb_pull is often triggered. -Fix the crash by adding the missing check. - -Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO") -Signed-off-by: Felix Fietkau ---- - net/ipv4/tcp_offload.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/net/ipv4/tcp_offload.c -+++ b/net/ipv4/tcp_offload.c -@@ -355,6 +355,7 @@ struct sk_buff *tcp_gro_receive(struct l - flush |= (__force int)(flags ^ tcp_flag_word(th2)); - flush |= skb->ip_summed != p->ip_summed; - flush |= skb->csum_level != p->csum_level; -+ flush |= !pskb_may_pull(skb, skb_gro_offset(skb)); - flush |= NAPI_GRO_CB(p)->count >= 64; - skb_set_network_header(skb, skb_gro_receive_network_offset(skb)); - diff --git a/target/linux/generic/pending-6.18/690-net-add-missing-check-for-TCP-fraglist-GRO.patch b/target/linux/generic/pending-6.18/690-net-add-missing-check-for-TCP-fraglist-GRO.patch deleted file mode 100644 index 9de4a6056e8..00000000000 --- a/target/linux/generic/pending-6.18/690-net-add-missing-check-for-TCP-fraglist-GRO.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 4498f0aa561092bc656bfabe7c4bdae41bc4a5b4 Mon Sep 17 00:00:00 2001 -From: Felix Fietkau -Date: Tue, 7 May 2024 11:24:50 +0200 -Subject: [PATCH] net: add missing check for TCP fraglist GRO - -It turns out that the existing checks do not guarantee that the skb can be -pulled up to the GRO offset. When using the usb r8152 network driver with -GRO fraglist, the BUG() in __skb_pull is often triggered. -Fix the crash by adding the missing check. - -Fixes: 8d95dc474f85 ("net: add code for TCP fraglist GRO") -Signed-off-by: Felix Fietkau ---- - net/ipv4/tcp_offload.c | 1 + - 1 file changed, 1 insertion(+) - ---- a/net/ipv4/tcp_offload.c -+++ b/net/ipv4/tcp_offload.c -@@ -359,6 +359,7 @@ struct sk_buff *tcp_gro_receive(struct l - flush |= (__force int)(flags ^ tcp_flag_word(th2)); - flush |= skb->ip_summed != p->ip_summed; - flush |= skb->csum_level != p->csum_level; -+ flush |= !pskb_may_pull(skb, skb_gro_offset(skb)); - flush |= NAPI_GRO_CB(p)->count >= 64; - skb_set_network_header(skb, skb_gro_receive_network_offset(skb)); -