idpf: fix potential use-after-free in idpf_tso()

skb_cow_head() can change skb->head (and thus skb_shinfo(skb))

We must not cache skb_shinfo(skb) before skb_cow_head().

Fixes: 6818c4d ("idpf: add splitq start_xmit")
Signed-off-by: Eric Dumazet <[email protected]>
Cc: Joshua Hay <[email protected]>
Cc: Alan Brady <[email protected]>
Cc: Madhu Chittim <[email protected]>
Cc: Phani Burra <[email protected]>
Cc: Sridhar Samudrala <[email protected]>
Cc: Willem de Bruijn <[email protected]>
Cc: Pavan Kumar Linga <[email protected]>
Cc: Tony Nguyen <[email protected]>
Cc: Bailey Forrest <[email protected]>
Reviewed-by: Jacob Keller <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>

Author: edumazet

drivers/net/ethernet/intel/idpf/idpf_txrx.c

@@ -2365,7 +2365,7 @@ static void idpf_tx_splitq_map(struct idpf_queue *tx_q,
  */
 int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
 {
-	const struct skb_shared_info *shinfo = skb_shinfo(skb);
+	const struct skb_shared_info *shinfo;
 	union {
 		struct iphdr *v4;
 		struct ipv6hdr *v6;
@@ -2379,13 +2379,15 @@ int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
 	u32 paylen, l4_start;
 	int err;
 
-	if (!shinfo->gso_size)
+	if (!skb_is_gso(skb))
 		return 0;
 
 	err = skb_cow_head(skb, 0);
 	if (err < 0)
 		return err;
 
+	shinfo = skb_shinfo(skb);
+
 	ip.hdr = skb_network_header(skb);
 	l4.hdr = skb_transport_header(skb);