setup_udp_tunnel_sock() installs the GRO handlers before updating the global static call. The socket is already bound, so packets can arrive while the static call still points to the handler for another tunnel type. Receive and completion can then parse the packet differently, leading to OOB write. Removing the static call is enough since the existing fallback already calls the handler selected during setup through call_gro_receive_sk(). The helper also performs the same recursion check and sets the flush flag when the limit is reached. Fixes: 5d7f5b2f6b93 ("udp_tunnel: use static call for GRO hooks when possible") Assisted-by: Codex:gpt-6 Signed-off-by: Jérémy Jean --- net/ipv4/udp_offload.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index cf07c3c..30649f4 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -148,13 +148,6 @@ static struct sk_buff *udp_tunnel_gro_rcv(struct sock *sk, struct list_head *head, struct sk_buff *skb) { - if (static_branch_likely(&udp_tunnel_static_call)) { - if (unlikely(gro_recursion_inc_test(skb))) { - NAPI_GRO_CB(skb)->flush |= 1; - return NULL; - } - return static_call(udp_tunnel_gro_rcv)(sk, head, skb); - } return call_gro_receive_sk(udp_sk(sk)->gro_receive, sk, head, skb); } -- 2.47.3