Patch "gro: Disable frag0 optimization on IPv6 ext headers" has been added to the 4.4-stable tree

This is a note to let you know that I've just added the patch titled

gro: Disable frag0 optimization on IPv6 ext headers

to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
gro-disable-frag0-optimization-on-ipv6-ext-headers.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Herbert Xu <[email protected]>
Date: Tue, 10 Jan 2017 12:24:15 -0800
Subject: gro: Disable frag0 optimization on IPv6 ext headers

From: Herbert Xu <[email protected]>

[ Upstream commit 57ea52a865144aedbcd619ee0081155e658b6f7d ]

The GRO fast path caches the frag0 address. This address becomes invalid if frag0 is modified by pskb_may_pull or its variants. So whenever that happens we must disable the frag0 optimization.

This is usually done through the combination of gro_header_hard and gro_header_slow, however, the IPv6 extension header path did the pulling directly and would continue to use the GRO fast path incorrectly.

This patch fixes it by disabling the fast path when we enter the IPv6 extension header path.

---
 include/linux/netdevice.h |    9 +++++++--
 net/ipv6/ip6_offload.c    |    1 +
 2 files changed, 8 insertions(+), 2 deletions(-)

@@ -2325,14 +2325,19 @@ static inline int skb_gro_header_hard(st
 	return NAPI_GRO_CB(skb)->frag0_len < hlen;
 }
 
+static inline void skb_gro_frag0_invalidate(struct sk_buff *skb)
+{
+	NAPI_GRO_CB(skb)->frag0 = NULL;
+	NAPI_GRO_CB(skb)->frag0_len = 0;
+}
+
 static inline void *skb_gro_header_slow(struct sk_buff *skb, unsigned int hlen,
 					unsigned int offset)
 {
 	if (!pskb_may_pull(skb, hlen))
 		return NULL;
 
-	NAPI_GRO_CB(skb)->frag0 = NULL;
-	NAPI_GRO_CB(skb)->frag0_len = 0;
+	skb_gro_frag0_invalidate(skb);
 	return skb->data + offset;
 }
 

@@ -196,6 +196,7 @@ static struct sk_buff **ipv6_gro_receive
 	ops = rcu_dereference(inet6_offloads[proto]);
 	if (!ops || !ops->callbacks.gro_receive) {
 		__pskb_pull(skb, skb_gro_offset(skb));
+		skb_gro_frag0_invalidate(skb);
 		proto = ipv6_gso_pull_exthdrs(skb, proto);
 		skb_gro_pull(skb, -skb_transport_offset(skb));
 		skb_reset_transport_header(skb);

Patches currently in stable-queue which might be from [email protected] are

queue-4.4/gro-disable-frag0-optimization-on-ipv6-ext-headers.patch queue-4.4/gro-enter-slow-path-if-there-is-no-tailroom.patch