From: Greg KH on
2.6.34-stable review patch. If anyone has any objections, please let us know.


From: Herbert Xu <herbert(a)>

[ Upstream commit 622e0ca1cd4d459f5af4f2c65f4dc0dd823cb4c3 ]

When GRO produces fraglist entries, and the resulting skb hits
an interface that is incapable of TSO but capable of FRAGLIST,
we end up producing a bogus packet with gso_size non-zero.

This was reported in the field with older versions of KVM that
did not set the TSO bits on tuntap.

This patch fixes that.

Reported-by: Igor Zhang <yugzhang(a)>
Signed-off-by: Herbert Xu <herbert(a)>
Signed-off-by: David S. Miller <davem(a)>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)>
net/core/skbuff.c | 1 +
1 file changed, 1 insertion(+)

--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2729,6 +2729,7 @@ int skb_gro_receive(struct sk_buff **hea
*NAPI_GRO_CB(nskb) = *NAPI_GRO_CB(p);
skb_shinfo(nskb)->frag_list = p;
skb_shinfo(nskb)->gso_size = pinfo->gso_size;
+ pinfo->gso_size = 0;
nskb->prev = p;

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)
More majordomo info at
Please read the FAQ at