From 5a4d4bf69221e823e37e4d80ab62056b4f2e7929 Mon Sep 17 00:00:00 2001 From: Erez Shitrit Date: Wed, 30 Apr 2014 10:45:20 +0300 Subject: [PATCH] IB/ipoib: Check gso size prior to ib_send We found that in some cases the kernel sends skb where the gso field was damaged, and the size of that field was bigger than the physical mtu, when the HW gets such size it flushes the qp to error state and all traffic on that interface is disabled. In order to avoid such case, i added a check to that field prior to the ib_send. Signed-off-by: Erez Shitrit (Ported from Mellanox OFED 2.4) Signed-off-by: Mukesh Kacker --- drivers/infiniband/ulp/ipoib/ipoib_ib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c index 63b92cbb29ad..75deac6a2c31 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c @@ -558,8 +558,10 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb, if (skb_is_gso(skb)) { hlen = skb_transport_offset(skb) + tcp_hdrlen(skb); phead = skb->data; - if (unlikely(!skb_pull(skb, hlen))) { - ipoib_warn(priv, "linear data too small\n"); + if (unlikely(!skb_pull(skb, hlen) || + (skb_shinfo(skb)->gso_size > priv->max_ib_mtu))) { + ipoib_warn(priv, "linear data too small: hlen: %d Or skb_shinfo(skb)->gso_size: %d is bigger than port-mtu: %d\n", + hlen, skb_shinfo(skb)->gso_size, priv->max_ib_mtu); ++dev->stats.tx_dropped; ++dev->stats.tx_errors; dev_kfree_skb_any(skb); -- 2.50.1