IB/ipoib: Check gso size prior to ib_send

We found that in some cases the kernel sends skb where the
gso field was damaged, and the size of that field was bigger
than the physical mtu, when the HW gets such size it flushes
the qp to error state and all traffic on that interface is
disabled.

In order to avoid such case, i added a check to that field
prior to the ib_send.

Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
(Ported from Mellanox OFED 2.4)

Signed-off-by: Mukesh Kacker <mukesh.kacker@oracle.com>

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 63b92cbb29ad0ad1f0165a738a47efbe0f650e04..75deac6a2c312747681cd16c1bb777759ec68247 100644 (file)
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -558,8 +558,10 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
        if (skb_is_gso(skb)) {
                hlen = skb_transport_offset(skb) + tcp_hdrlen(skb);
                phead = skb->data;
-               if (unlikely(!skb_pull(skb, hlen))) {
-                       ipoib_warn(priv, "linear data too small\n");
+               if (unlikely(!skb_pull(skb, hlen) ||
+                            (skb_shinfo(skb)->gso_size > priv->max_ib_mtu))) {
+                       ipoib_warn(priv, "linear data too small: hlen: %d Or skb_shinfo(skb)->gso_size: %d is bigger than port-mtu: %d\n",
+                                  hlen, skb_shinfo(skb)->gso_size, priv->max_ib_mtu);
                        ++dev->stats.tx_dropped;
                        ++dev->stats.tx_errors;
                        dev_kfree_skb_any(skb);