[PATCH net v1] net: gro: avoid nesting GSO skbs in skb_gro_receive_list()

[Antoine Tenart]

On Wed, Jul 22, 2026 at 10:42:14AM +0800, zhaoping.shu at mediatek.com wrote:
> From: HW He <hw.he at mediatek.com>
> 
> On devices that support both NETIF_F_GRO_HW and NETIF_F_GRO_FRAGLIST,
> the hardware or driver may deliver packets that have already been
> aggregated into a GSO skb, either with frags[] or frag_list. GRO may
> then
> aggregate the skb again in skb_gro_receive_list().
> 
> This can create a nested GSO skb, which is not handled correctly by the
> later GSO segmentation paths. When the skb is segmented by
> skb_segment_list(), it not be fully restored to the original packets.
> 
> If the skb is marked with SKB_GSO_DODGY before segmentation, for example
> after a protocol change from IPv6 to IPv4, the nested GSO skb is
> segmented
> by skb_segment(), which may hit a NULL pointer dereference when the skb
> contains a nested frag_list.
> 
> Avoid this by setting NAPI_GRO_CB(skb)->flush for GSO skbs before
> aggregation and by checking the flush flag in skb_gro_receive_list(),
> following the existing logic in skb_gro_receive().
> 
> Signed-off-by: HW He <hw.he at mediatek.com>
> Signed-off-by: Zhaoping Shu <zhaoping.shu at mediatek.com>
> ---
>  net/core/gro.c         | 2 +-
>  net/ipv4/tcp_offload.c | 1 +
>  2 files changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/gro.c b/net/core/gro.c
> index 35f2f708f010..27c9813495f3 100644
> --- a/net/core/gro.c
> +++ b/net/core/gro.c
> @@ -229,7 +229,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
>  
>  int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb)
>  {
> -	if (unlikely(p->len + skb->len >= 65536))
> +	if (unlikely(p->len + skb->len >= 65536 || NAPI_GRO_CB(skb)->flush))
>  		return -E2BIG;

This was already fixed in e751256486d0 ("net: gro: fix double
aggregation of flush-marked skbs").
>  
>  	if (!pskb_may_pull(skb, skb_gro_offset(skb))) {
> diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
> index 3b1fdcd3cb29..c363434a5646 100644
> --- a/net/ipv4/tcp_offload.c
> +++ b/net/ipv4/tcp_offload.c
> @@ -332,6 +332,7 @@ struct sk_buff *tcp_gro_receive(struct list_head *head, struct sk_buff *skb,
>  		flush |= skb->ip_summed != p->ip_summed;
>  		flush |= skb->csum_level != p->csum_level;
>  		flush |= NAPI_GRO_CB(p)->count >= 64;
> +		NAPI_GRO_CB(skb)->flush |= skb_is_gso(skb);
>  		skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
>  
>  		if (flush || skb_gro_receive_list(p, skb))

I haven't looked closely but this looks like a second issue and would
need its own patch with a proper description.

Thanks,
Antoine