From: Erez Shitrit Date: Wed, 30 Apr 2014 07:45:20 +0000 (+0300) Subject: IB/ipoib: Check gso size prior to ib_send X-Git-Tag: v4.1.12-92~293^2~1^2~36 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=5a4d4bf69221e823e37e4d80ab62056b4f2e7929;p=users%2Fjedix%2Flinux-maple.git IB/ipoib: Check gso size prior to ib_send We found that in some cases the kernel sends skb where the gso field was damaged, and the size of that field was bigger than the physical mtu, when the HW gets such size it flushes the qp to error state and all traffic on that interface is disabled. In order to avoid such case, i added a check to that field prior to the ib_send. Signed-off-by: Erez Shitrit (Ported from Mellanox OFED 2.4) Signed-off-by: Mukesh Kacker --- diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c index 63b92cbb29ad0..75deac6a2c312 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c @@ -558,8 +558,10 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb, if (skb_is_gso(skb)) { hlen = skb_transport_offset(skb) + tcp_hdrlen(skb); phead = skb->data; - if (unlikely(!skb_pull(skb, hlen))) { - ipoib_warn(priv, "linear data too small\n"); + if (unlikely(!skb_pull(skb, hlen) || + (skb_shinfo(skb)->gso_size > priv->max_ib_mtu))) { + ipoib_warn(priv, "linear data too small: hlen: %d Or skb_shinfo(skb)->gso_size: %d is bigger than port-mtu: %d\n", + hlen, skb_shinfo(skb)->gso_size, priv->max_ib_mtu); ++dev->stats.tx_dropped; ++dev->stats.tx_errors; dev_kfree_skb_any(skb);