[PATCH] gro: fix payload corruption in coalescing packets

[PATCH] gro: fix payload corruption in coalescing packets

[Tathagat Priyadarshi]

In the current implementation when cmp is larger than 0,
the new packet is appended to the original packet. However
the code is operating on the trailing packet to update the tcp flags
which ends up corrupting the payload of the trailing packets.

Fixes: 547f29435769 ("gro: fix reordering of packets")
Cc: stable@dpdk.org

Signed-off-by: Tathagat Priyadarshi <tathagat.dpdk@gmail.com>
---
 lib/gro/gro_tcp.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/gro/gro_tcp.h b/lib/gro/gro_tcp.h
index e9be7b95d1..43383e47e0 100644
--- a/lib/gro/gro_tcp.h
+++ b/lib/gro/gro_tcp.h
@@ -133,7 +133,7 @@ merge_two_tcp_packets(struct gro_tcp_item *item,
 	pkt_head->nb_segs += pkt_tail->nb_segs;
 	pkt_head->pkt_len += pkt_tail->pkt_len;
 	if (tcp_flags != RTE_TCP_ACK_FLAG) {
-		tcp_hdr = rte_pktmbuf_mtod_offset(pkt, struct rte_tcp_hdr *,
+		tcp_hdr = rte_pktmbuf_mtod_offset(pkt_head, struct rte_tcp_hdr *,
 						l2_offset + pkt_head->l2_len + pkt_head->l3_len);
 		tcp_hdr->tcp_flags |= tcp_flags;
 	}
-- 
2.34.1

Re: [PATCH] gro: fix payload corruption in coalescing packets

[kumaraparameshwaran rathinavel]

[-- Attachment #1: Type: text/plain, Size: 1400 bytes --]

Reviewed by : @kumaraparameshwaran rathinavel <kumaraparamesh92@gmail.com>

On Tue, Sep 2, 2025 at 4:14 PM Tathagat Priyadarshi <tathagat.dpdk@gmail.com>
wrote:

> In the current implementation when cmp is larger than 0,
> the new packet is appended to the original packet. However
> the code is operating on the trailing packet to update the tcp flags
> which ends up corrupting the payload of the trailing packets.
>
> Fixes: 547f29435769 ("gro: fix reordering of packets")
> Cc: stable@dpdk.org
>
> Signed-off-by: Tathagat Priyadarshi <tathagat.dpdk@gmail.com>
> ---
>  lib/gro/gro_tcp.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/gro/gro_tcp.h b/lib/gro/gro_tcp.h
> index e9be7b95d1..43383e47e0 100644
> --- a/lib/gro/gro_tcp.h
> +++ b/lib/gro/gro_tcp.h
> @@ -133,7 +133,7 @@ merge_two_tcp_packets(struct gro_tcp_item *item,
>         pkt_head->nb_segs += pkt_tail->nb_segs;
>         pkt_head->pkt_len += pkt_tail->pkt_len;
>         if (tcp_flags != RTE_TCP_ACK_FLAG) {
> -               tcp_hdr = rte_pktmbuf_mtod_offset(pkt, struct rte_tcp_hdr
> *,
> +               tcp_hdr = rte_pktmbuf_mtod_offset(pkt_head, struct
> rte_tcp_hdr *,
>                                                 l2_offset +
> pkt_head->l2_len + pkt_head->l3_len);
>                 tcp_hdr->tcp_flags |= tcp_flags;
>         }
> --
> 2.34.1
>
>

[-- Attachment #2: Type: text/html, Size: 2049 bytes --]