From 7f8ccd643eb6a99dbe60780b4440318d5c5f31a4 Mon Sep 17 00:00:00 2001
From: jan <jan@openbsd.org>
Date: Tue, 7 May 2024 18:35:23 +0000
Subject: [PATCH] Additional check for TSO packets with 0 MSS.

Tested by bluhm

ok bluhm@
---
 sys/dev/pci/if_bnxt.c | 4 ++--
 sys/dev/pci/if_em.c   | 4 ++--
 sys/dev/pci/if_igc.c  | 4 ++--
 sys/dev/pci/if_ix.c   | 4 ++--
 sys/dev/pci/if_ixl.c  | 4 ++--
 sys/dev/pci/if_vmx.c  | 4 ++--
 sys/dev/pv/if_vio.c   | 4 ++--
 7 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/sys/dev/pci/if_bnxt.c b/sys/dev/pci/if_bnxt.c
index c973a624bc6..3dadfafca81 100644
--- a/sys/dev/pci/if_bnxt.c
+++ b/sys/dev/pci/if_bnxt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_bnxt.c,v 1.48 2024/04/12 19:27:43 jan Exp $	*/
+/*	$OpenBSD: if_bnxt.c,v 1.49 2024/05/07 18:35:23 jan Exp $	*/
 /*-
  * Broadcom NetXtreme-C/E network driver.
  *
@@ -1427,7 +1427,7 @@ bnxt_start(struct ifqueue *ifq)
 			uint32_t paylen;
 
 			ether_extract_headers(m, &ext);
-			if (ext.tcp) {
+			if (ext.tcp && m->m_pkthdr.ph_mss > 0) {
 				lflags |= TX_BD_LONG_LFLAGS_LSO;
 				hdrsize = sizeof(*ext.eh);
 				if (ext.ip4 || ext.ip6)
diff --git a/sys/dev/pci/if_em.c b/sys/dev/pci/if_em.c
index 18d540e8597..f9b85546e26 100644
--- a/sys/dev/pci/if_em.c
+++ b/sys/dev/pci/if_em.c
@@ -31,7 +31,7 @@ POSSIBILITY OF SUCH DAMAGE.
 
 ***************************************************************************/
 
-/* $OpenBSD: if_em.c,v 1.374 2024/02/16 22:30:54 mglocker Exp $ */
+/* $OpenBSD: if_em.c,v 1.375 2024/05/07 18:35:23 jan Exp $ */
 /* $FreeBSD: if_em.c,v 1.46 2004/09/29 18:28:28 mlaier Exp $ */
 
 #include <dev/pci/if_em.h>
@@ -2452,7 +2452,7 @@ em_tso_setup(struct em_queue *que, struct mbuf *mp, u_int head,
 #endif
 
 	ether_extract_headers(mp, &ext);
-	if (ext.tcp == NULL)
+	if (ext.tcp == NULL || mp->m_pkthdr.ph_mss == 0)
 		goto out;
 
 	vlan_macip_lens |= (sizeof(*ext.eh) << E1000_ADVTXD_MACLEN_SHIFT);
diff --git a/sys/dev/pci/if_igc.c b/sys/dev/pci/if_igc.c
index 693a7e79e52..cd8f0a27dc9 100644
--- a/sys/dev/pci/if_igc.c
+++ b/sys/dev/pci/if_igc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_igc.c,v 1.22 2024/05/06 04:25:52 dlg Exp $	*/
+/*	$OpenBSD: if_igc.c,v 1.23 2024/05/07 18:35:23 jan Exp $	*/
 /*-
  * SPDX-License-Identifier: BSD-2-Clause
  *
@@ -2093,7 +2093,7 @@ igc_tx_ctx_setup(struct tx_ring *txr, struct mbuf *mp, int prod,
 	}
 
 	if (ISSET(mp->m_pkthdr.csum_flags, M_TCP_TSO)) {
-		if (ext.tcp) {
+		if (ext.tcp && mp->m_pkthdr.ph_mss > 0) {
 			uint32_t hdrlen, thlen, paylen, outlen;
 
 			thlen = ext.tcphlen;
diff --git a/sys/dev/pci/if_ix.c b/sys/dev/pci/if_ix.c
index 014f818edaa..01d0a2528c6 100644
--- a/sys/dev/pci/if_ix.c
+++ b/sys/dev/pci/if_ix.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ix.c,v 1.212 2024/05/01 10:43:42 jan Exp $	*/
+/*	$OpenBSD: if_ix.c,v 1.213 2024/05/07 18:35:23 jan Exp $	*/
 
 /******************************************************************************
 
@@ -2535,7 +2535,7 @@ ixgbe_tx_offload(struct mbuf *mp, uint32_t *vlan_macip_lens,
 	}
 
 	if (mp->m_pkthdr.csum_flags & M_TCP_TSO) {
-		if (ext.tcp) {
+		if (ext.tcp && mp->m_pkthdr.ph_mss > 0) {
 			uint32_t hdrlen, thlen, paylen, outlen;
 
 			thlen = ext.tcphlen;
diff --git a/sys/dev/pci/if_ixl.c b/sys/dev/pci/if_ixl.c
index b5b1777cbb7..36ce95aac55 100644
--- a/sys/dev/pci/if_ixl.c
+++ b/sys/dev/pci/if_ixl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_ixl.c,v 1.98 2024/04/12 19:27:43 jan Exp $ */
+/*	$OpenBSD: if_ixl.c,v 1.99 2024/05/07 18:35:23 jan Exp $ */
 
 /*
  * Copyright (c) 2013-2015, Intel Corporation
@@ -2848,7 +2848,7 @@ ixl_tx_setup_offload(struct mbuf *m0, struct ixl_tx_ring *txr,
 	}
 
 	if (ISSET(m0->m_pkthdr.csum_flags, M_TCP_TSO)) {
-		if (ext.tcp) {
+		if (ext.tcp && m0->m_pkthdr.ph_mss > 0) {
 			struct ixl_tx_desc *ring, *txd;
 			uint64_t cmd = 0, paylen, outlen;
 
diff --git a/sys/dev/pci/if_vmx.c b/sys/dev/pci/if_vmx.c
index 81bb0834cff..87e9c926c21 100644
--- a/sys/dev/pci/if_vmx.c
+++ b/sys/dev/pci/if_vmx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_vmx.c,v 1.83 2024/04/02 20:59:48 jan Exp $	*/
+/*	$OpenBSD: if_vmx.c,v 1.84 2024/05/07 18:35:23 jan Exp $	*/
 
 /*
  * Copyright (c) 2013 Tsubai Masanari
@@ -1463,7 +1463,7 @@ vmxnet3_tx_offload(struct vmxnet3_txdesc *sop, struct mbuf *m)
 	 * TCP Segmentation Offload
 	 */
 
-	if (ext.tcp == NULL) {
+	if (ext.tcp == NULL || m->m_pkthdr.ph_mss == 0) {
 		tcpstat_inc(tcps_outbadtso);
 		return;
 	}
diff --git a/sys/dev/pv/if_vio.c b/sys/dev/pv/if_vio.c
index 9ad8e36e346..919c2aa1329 100644
--- a/sys/dev/pv/if_vio.c
+++ b/sys/dev/pv/if_vio.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_vio.c,v 1.32 2024/04/10 19:55:50 jan Exp $	*/
+/*	$OpenBSD: if_vio.c,v 1.33 2024/05/07 18:35:23 jan Exp $	*/
 
 /*
  * Copyright (c) 2012 Stefan Fritsch, Alexander Fiveg.
@@ -777,7 +777,7 @@ vio_tx_offload(struct virtio_net_hdr *hdr, struct mbuf *m)
 	if (!ISSET(m->m_pkthdr.csum_flags, M_TCP_TSO))
 		return;
 
-	if (!ext.tcp) {
+	if (!ext.tcp || m->m_pkthdr.ph_mss == 0) {
 		tcpstat_inc(tcps_outbadtso);
 		return;
 	}
-- 
2.20.1