[PATCH] gro: fix payload corruption in coalescing packets

[kumaraparameshwaran rathinavel]

Reviewed by : @kumaraparameshwaran rathinavel <kumaraparamesh92 at gmail.com>

On Tue, Sep 2, 2025 at 4:14 PM Tathagat Priyadarshi <tathagat.dpdk at gmail.com>
wrote:

> In the current implementation when cmp is larger than 0,
> the new packet is appended to the original packet. However
> the code is operating on the trailing packet to update the tcp flags
> which ends up corrupting the payload of the trailing packets.
>
> Fixes: 547f29435769 ("gro: fix reordering of packets")
> Cc: stable at dpdk.org
>
> Signed-off-by: Tathagat Priyadarshi <tathagat.dpdk at gmail.com>
> ---
>  lib/gro/gro_tcp.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/gro/gro_tcp.h b/lib/gro/gro_tcp.h
> index e9be7b95d1..43383e47e0 100644
> --- a/lib/gro/gro_tcp.h
> +++ b/lib/gro/gro_tcp.h
> @@ -133,7 +133,7 @@ merge_two_tcp_packets(struct gro_tcp_item *item,
>         pkt_head->nb_segs += pkt_tail->nb_segs;
>         pkt_head->pkt_len += pkt_tail->pkt_len;
>         if (tcp_flags != RTE_TCP_ACK_FLAG) {
> -               tcp_hdr = rte_pktmbuf_mtod_offset(pkt, struct rte_tcp_hdr
> *,
> +               tcp_hdr = rte_pktmbuf_mtod_offset(pkt_head, struct
> rte_tcp_hdr *,
>                                                 l2_offset +
> pkt_head->l2_len + pkt_head->l3_len);
>                 tcp_hdr->tcp_flags |= tcp_flags;
>         }
> --
> 2.34.1
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/stable/attachments/20250918/f9b24167/attachment.htm>