udp: fix GRO reception in case of length mismatch [Linux 5.1]

udp: fix GRO reception in case of length mismatch [Linux 5.1]

This Linux kernel change "udp: fix GRO reception in case of length mismatch" is included in the Linux 5.1 release. This change is authored by Paolo Abeni <pabeni [at] redhat.com> on Fri Apr 26 12:50:44 2019 +0200. The commit for this change in Linux stable tree is 21f1b8a (patch).

udp: fix GRO reception in case of length mismatch

Currently, the UDP GRO code path does bad things on some edge
conditions - Aggregation can happen even on packet with different

Fix the above by rewriting the 'complete' condition for GRO
packets. While at it, note explicitly that we allow merging the
first packet per burst below gso_size.

Reported-by: Sean Tong <seantong114@gmail.com>
Fixes: e20cf8d3f1f7 ("udp: implement GRO for plain UDP sockets.")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

There are 9 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 net/ipv4/udp_offload.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 64f9715..d8776b2 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -377,13 +377,14 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,

        /* Terminate the flow on len mismatch or if it grow "too much".
         * Under small packet flood GRO count could elsewhere grow a lot
-        * leading to execessive truesize values
+        * leading to execessive truesize values.
+        * On len mismatch merge the first packet shorter than gso_size,
+        * otherwise complete the GRO packet.
-       if (!skb_gro_receive(p, skb) &&
+       if (uh->len > uh2->len || skb_gro_receive(p, skb) ||
+           uh->len != uh2->len ||
            NAPI_GRO_CB(p)->count >= UDP_GRO_CNT_MAX)
            pp = p;
-       else if (uh->len != uh2->len)
-           pp = p;

        return pp;

Leave a Reply

Your email address will not be published. Required fields are marked *