kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net
History
Yingnan Zhang 69bee27edb ipvs: fix MTU check for GSO packets in tunnel mode 
[ Upstream commit 67bf42cae4 ]

Currently, IPVS skips MTU checks for GSO packets by excluding them with
the !skb_is_gso(skb) condition. This creates problems when IPVS tunnel
mode encapsulates GSO packets with IPIP headers.

The issue manifests in two ways:

1. MTU violation after encapsulation:
   When a GSO packet passes through IPVS tunnel mode, the original MTU
   check is bypassed. After adding the IPIP tunnel header, the packet
   size may exceed the outgoing interface MTU, leading to unexpected
   fragmentation at the IP layer.

2. Fragmentation with problematic IP IDs:
   When net.ipv4.vs.pmtu_disc=1 and a GSO packet with multiple segments
   is fragmented after encapsulation, each segment gets a sequentially
   incremented IP ID (0, 1, 2, ...). This happens because:

   a) The GSO packet bypasses MTU check and gets encapsulated
   b) At __ip_finish_output, the oversized GSO packet is split into
      separate SKBs (one per segment), with IP IDs incrementing
   c) Each SKB is then fragmented again based on the actual MTU

   This sequential IP ID allocation differs from the expected behavior
   and can cause issues with fragment reassembly and packet tracking.

Fix this by properly validating GSO packets using
skb_gso_validate_network_len(). This function correctly validates
whether the GSO segments will fit within the MTU after segmentation. If
validation fails, send an ICMP Fragmentation Needed message to enable
proper PMTU discovery.

Fixes: 4cdd34084d ("netfilter: nf_conntrack_ipv6: improve fragmentation handling")
Signed-off-by: Yingnan Zhang <342144303@qq.com>
Acked-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-06-01 17:35:39 +02:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-07-22 16:19:03 +02:00
9p net/9p: fix double req put in p9_fd_cancelled 2025-10-19 16:21:28 +02:00
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-23 17:15:49 +01:00
8021q net: vlan: sync VLAN features with lower device 2025-12-07 06:09:26 +09:00
appletalk net: appletalk: Fix use-after-free in AARP proxy probe 2025-08-28 16:24:04 +02:00
atm atm: lec: fix use-after-free in sock_def_readable() 2026-04-18 10:33:29 +02:00
ax25 ax25: properly unshare skbs in ax25_kiss_rcv() 2025-09-09 18:50:20 +02:00
batman-adv batman-adv: bla: put backbone reference on failed claim hash insert 2026-06-01 17:35:26 +02:00
bluetooth Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp 2026-06-01 17:35:29 +02:00
bpf bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb 2026-06-01 17:35:29 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-06-25 13:13:50 +02:00
bridge bridge: br_nd_send: validate ND option lengths 2026-04-18 10:33:33 +02:00
caif net: caif: clear client service pointer on teardown 2026-06-01 17:35:14 +02:00
can can: raw: fix ro->uniq use-after-free in raw_rcv() 2026-06-01 17:35:04 +02:00
ceph libceph: Fix slab-out-of-bounds access in auth message processing 2026-06-01 17:35:23 +02:00
core flow_dissector: Add PPPoE dissectors 2026-06-01 17:35:39 +02:00
dcb net: dcb: choose correct policy to parse DCB_ATTR_BCN 2023-08-11 15:13:53 +02:00
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:16:04 +01:00
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-01-25 14:52:46 -08:00
dsa net: dsa: free routing table on probe failure 2026-02-19 16:21:45 +01:00
ethernet gro: remove rcu_read_lock/rcu_read_unlock from gro_complete handlers 2024-09-12 11:07:47 +02:00
ethtool ethtool: add support to set/get tx copybreak buf size via ethtool 2026-03-04 07:19:36 -05:00
hsr net: hsr: fix VLAN add unwind on slave errors 2026-04-18 10:33:31 +02:00
ieee802154 net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() 2024-12-14 19:51:37 +01:00
ife net: sched: ife: fix potential use-after-free 2024-01-05 15:13:29 +01:00
ipv4 tcp: annotate data-races around (tp->write_seq - tp->snd_nxt) 2026-06-01 17:35:38 +02:00
ipv6 ipv6: fix possible UAF in icmpv6_rcv() 2026-06-01 17:35:38 +02:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-09-04 13:23:27 +02:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-09-04 13:23:32 +02:00
key af_key: validate families in pfkey_send_migrate() 2026-04-18 10:33:24 +02:00
l2tp l2tp: Drop large packets with UDP encap 2026-06-01 17:35:03 +02:00
l3mdev net: Add l3mdev index to flow struct and avoid oif reset for port devices 2024-10-17 15:11:57 +02:00
lapb net: lapb: Use list_for_each_entry() to simplify code in lapb_iface.c 2021-06-08 16:31:25 -07:00
llc llc: fix data loss when reading from a socket in llc_ui_recvmsg() 2025-06-04 14:38:06 +02:00
mac80211 wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure 2026-06-01 17:35:07 +02:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:16:00 +01:00
mctp net: mctp: Don't access ifa_index when missing 2026-04-18 10:33:35 +02:00
mpls mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). 2025-06-27 11:05:36 +01:00
mptcp mptcp: fix scheduling with atomic in timestamp sockopt 2026-06-01 17:35:24 +02:00
ncsi net: ncsi: fix skb leak in error paths 2026-04-18 10:33:15 +02:00
netfilter ipvs: fix MTU check for GSO packets in tunnel mode 2026-06-01 17:35:39 +02:00
netlabel calipso: unlock rcu before returning -EAFNOSUPPORT 2025-06-27 11:05:22 +01:00
netlink netlink: avoid infinite retry looping in netlink_unicast() 2025-08-28 16:24:15 +02:00
netrom netrom: fix double-free in nr_route_frame() 2026-02-06 16:41:58 +01:00
nfc NFC: digital: Bounds check NFC-A cascade depth in SDD response handler 2026-06-01 17:35:04 +02:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-05-17 11:50:48 +02:00
openvswitch openvswitch: cap upcall PID array size and pre-size vport replies 2026-06-01 17:35:39 +02:00
packet net: fix fanout UAF in packet_release() via NETDEV_UP race 2026-04-18 10:33:25 +02:00
phonet phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() 2025-08-28 16:23:59 +02:00
psample psample: Require 'CAP_NET_ADMIN' when joining "packets" group 2023-12-13 18:36:37 +01:00
qrtr net: qrtr: ns: Fix use-after-free in driver remove() 2026-06-01 17:35:14 +02:00
rds net/rds: Restrict use of RDS/IB to the initial network namespace 2026-06-01 17:35:29 +02:00
rfkill net: rfkill: prevent unlimited numbers of rfkill events from being created 2026-04-18 10:33:38 +02:00
rose net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect 2026-04-18 10:33:20 +02:00
rxrpc rxrpc: Fix missing validation of ticket length in non-XDR key preparsing 2026-06-01 17:35:12 +02:00
sched net/sched: taprio: fix use-after-free in advance_sched() on schedule switch 2026-06-01 17:35:38 +02:00
sctp sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks 2026-06-01 17:35:38 +02:00
smc net/smc: avoid early lgr access in smc_clc_wait_msg 2026-06-01 17:35:15 +02:00
strparser net: strparser: fix skb_head leak in strp_abort_strp() 2026-06-01 17:35:14 +02:00
sunrpc SUNRPC: lock against ->sock changing during sysfs read 2026-06-01 17:35:11 +02:00
switchdev net: make switchdev_bridge_port_{,unoffload} loosely coupled with the bridge 2021-08-04 12:35:07 +01:00
tipc tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG 2026-04-18 10:33:36 +02:00
tls net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption 2026-04-18 10:33:37 +02:00
unix af_unix: read UNIX_DIAG_VFS data under unix_state_lock 2026-06-01 17:35:03 +02:00
vmw_vsock vsock/virtio: fix accept queue count leak on transport mismatch 2026-06-01 17:35:26 +02:00
wireless Revert "wifi: cfg80211: stop NAN and P2P in cfg80211_leave" 2026-06-01 17:35:12 +02:00
x25 net/x25: Fix overflow when accumulating packets 2026-04-18 10:33:31 +02:00
xdp xsk: tighten UMEM headroom validation to account for tailroom and min frame 2026-06-01 17:35:02 +02:00
xfrm xfrm: provide message size for XFRM_MSG_MAPPING 2026-06-01 17:35:21 +02:00
compat.c net: Return the correct errno code 2021-06-03 15:13:56 -07:00
devres.c net: devres: Correct a grammatical error 2021-06-11 12:55:28 -07:00
Kconfig Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
Makefile Remove DECnet support from kernel 2023-06-21 15:59:15 +02:00
socket.c net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. 2026-01-19 13:10:11 +01:00
sysctl_net.c net: Ensure net namespace isolation of sysctls 2021-04-12 13:27:11 -07:00