From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672954; cv=none; d=zohomail.com; s=zohoarc; b=ZU5T4v9aCXZ1Sd16rwZ9pCVVLNAu5QvDe6wSV0JoiJUJVw14Mm31wCKn7rSWGPglJ1E7NotUc9YT8qG/dRYCIcAd37ECtGmB65jMqZ0doXQc2FtN7pptAOVnn6i7/bfd5QEBVLvivEUQZUSVPtRWyILdkyV75k7+jeN+f5rIqPQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672954; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=ItNbbfoSMigin0nEzX5YnYh+yWL40HL4VuZt49ucLwc=; b=LSTwv6WoHl0UVsAWV55EH5seJpSMnlwrcQoiUhQXHd0DrSz5MTHtjPdafXqAYysubOIuXRHNqcp5QQqou5p2wJjZxz7bMrp3ajMhq/DCMuOIRibI3aLrBiRCkNEbMD9USwj7NYrlliLPv4dtJLWAonc7Q894vUz2iDbiRv9uKvA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672954403639.5816873375737; Mon, 2 Nov 2026 18:29:14 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468930.1677926 (Exim 4.92) (envelope-from ) id 1xO4GZ-0006ut-78; Tue, 03 Nov 2026 02:28:51 +0000 Received: by outflank-mailman (output) from mailman id 1468930.1677926; Tue, 03 Nov 2026 02:28:51 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4GZ-0006um-3Z; Tue, 03 Nov 2026 02:28:51 +0000 Received: by outflank-mailman (input) for mailman id 1468930; Tue, 03 Nov 2026 02:28:50 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4GX-0006hu-TF for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:28:50 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4GX-009OZN-9z for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:28:49 +0100 Received: from [10.42.69.2] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae946df-bab6-0a2a0a5309dd-0a2a4502d736-6 for ; Tue, 03 Nov 2026 03:28:49 +0100 Received: from [209.85.160.173] (helo=mail-qt1-f173.google.com) by tlsNG-720697.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946e0-6ca4-0a2a45020019-d155a0adb96a-3 for ; Tue, 03 Nov 2026 03:28:48 +0100 Received: by mail-qt1-f173.google.com with SMTP id d75a77b69052e-5361e313e63so42598121cf.3 for ; Mon, 02 Nov 2026 18:28:48 -0800 (PST) Received: from toxicpanda.com ([153.61.196.253]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5498b49ce29sm13831151cf.4.2026.11.02.18.28.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:28:46 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672927; x=1794277727; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ItNbbfoSMigin0nEzX5YnYh+yWL40HL4VuZt49ucLwc=; b=ME9KaolzjM0pMPlIz3gPR06dtDMkJRZTKvVMdA+uQesc+qSHd3VOt9hmJaDBbSmkpL ypG8vlsPOYZOyKCFY5cI86mIH4FlQK+oF7PpCvB38f6marJ80lRrXs2uN46RaY9p6udu dqqNyYVomtxrDs2MUHZc7iQm16qXmbcrBW12wejqAO1k09/6eo1jC8GZLfDAXv6A0JZN x+SUU4/ygwsjBbL7ll6MzCrHOQ6Nlf1T7IM8vK1zUNrrgYjrLbuABnO3pcR5LLyG5hQO lyxKy1kqBm2JQ3Bf8sisxamQ37ri2+mLcTKqmDFP84jvKHhLkVvxT6NZc014K7GWle6i Qu8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672927; x=1794277727; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ItNbbfoSMigin0nEzX5YnYh+yWL40HL4VuZt49ucLwc=; b=T6wDgHnoF1UZFrxH/6SvlzZ1NC0nAlLirwN43RN6DJ9QRe/2Yid8NBxDPbQn+BHbYG S1Tw7UBQvmkqqUnpDjB1yGn+RpTl9i17lKHUihyeDlDFKWQi//3fH5TMH4XWjDCr90h+ dKsNRxY8Gc4TH9/Wltt5rBULnGsJ+yr1CL3kKXmzwOYBA7I9PZRRkUZ4ZvRjUPDNLEAL I6mD5oUe8rdlgJIXkU1h6PKNhc2i9w/A8MTAF5gqKTO/39SCD8nrNRtw7AxJ9tXVe3BO Rg/+vZU9NRWuubTL4mQcvQA8vsMJgL/vDwwNrpxx2ZSyu0bQB/3GhubVEyTwnt437r29 YamQ== X-Forwarded-Encrypted: i=1; AKwUvByjQ/ZXRZXwjeggghgTZTfddp5H9YYLFgbtShEcKO9k8sDOGpsLg1CmAqCJXJR3HmjpuactVFV3XKI=@lists.xenproject.org X-Gm-Message-State: AFq9FYL0PpZVWoq7XwyyGzsar0Rx/l9fI5ED48ZUqYWgPsE04J/044L6 Q21DvyqY/WSGtG/44Jok2dcu0P+tDTTwN8RBZQEjvBVMzuUENoZR7EiOYVAQ+zZP470= X-Gm-Gg: AYBFou2j0k0Rg8rkugt55np+K2DBMV8FHvuq2HnJqWx64zti0wT+oaC045XmdpDGdph t0b8NLQJwybcG2dxuV3ZUuaxq1QCeH8xRdNSeHNHIYZRQdJtp+RBYsBjVisdmG25sh3oLFa8SCB bDUtd0sWG3Wmv82AnCgJXkNV7yoGmY0XpAuUsG85n09iZihN8qFoK5pSqHOPotpCTi6Z2/D2V8/ V9NumNkUyMJezVCyqwE/r6CKKmwfKmQjcEy5WGfHKaxhrzupEwXvW4ZzFnrPRt6VvxarmrEdyi7 +LuwnG/DxzB+/N5VJV1Bu41jGIsxKLZZTX5URQJF/v2lsjTsSoJeogpa5hxyZo0HibJ9rMVs612 SdLXbvZQmIFfqMevonZ/F/UwX2tjCS4GsmLB8RfVD/uNcIWa518Bwqdvr1tUmqY4MdbADaHiOs4 P3jMoTQjne1YmFPXtIDKisgqkCQXMf3jroUuWrI9T5vSXbXsSkhCRFDOj6M7ZGOPppJ2UA8Zf57 5XM9to3LUoC+UfHMl7VSGPgMCJo7AlYiImvOJYfsDjzroxcO+Xwk4MfS47wu8EulxXM9evdqll2 PSaFVAG0Y8IWX4KJRg8BVqbK8oUpZm2tGlgnYz+qzQb/Gg== X-Received: by 2002:a05:622a:394:b0:536:699d:9a1c with SMTP id d75a77b69052e-542b3979709mr204371611cf.2.1793672927274; Mon, 02 Nov 2026 18:28:47 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:27 +0000 Subject: [PATCH net-next v3 01/15] net: skbuff: make skb_copy_and_csum_bits() report unreadable frags MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-1-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672922; l=13352; i=josef@toxicpanda.com; h=from:subject:message-id; bh=+G2u4WuzqFRwukhQ5bvu8a1h5fsGccFSEyEcvJUXbLo=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QHioHkzRf9qW/+GyWuZtNQbmDIwqaFZOeLV1PK/nMSdeCk5HhZyyNtfxFqCDDkBgs6hQVxRSgTd IkeyQ2Cw97w8= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-720697/1793672929-F16AF2AC-A8D3A098/0/0 X-purgate-type: clean X-purgate-size: 13354 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672955676158500 skb_copy_and_csum_bits() has no way to fail. When it reaches unreadable frags, or runs out of skb before @len, it zero-fills the rest of the buffer and returns 0. Its callers can't tell that the copy didn't happen. In the !sg && !csum branch of skb_segment() that turns a devmem TCP payload into zeroes under a valid TCP checksum, and the peer accepts them as stream data. It takes a device with both SG and TX checksum offload turned off. A test module that segments an skb with 3000 bytes in an unreadable frag gets 3 all-zero segments before this patch and -EFAULT after it. Return 0 or -EFAULT, hand the checksum back through a pointer, and mark the function __must_check. Every caller takes the error path it already has for a failed copy. skb_copy_and_csum_dev() can't return an error, so it zeroes the whole frame. csum_partial_copy_to_xdr() no longer checksums the bytes it didn't copy. That only ran when the function was about to fail anyway, and skb_checksum() warns on an unreadable skb. The frag_list loop takes the address of a local, so it moves into a noinline function to keep a stack protector out of skb_copy_and_csum_bits(). Found by the Sashiko AI review of commit ab9414ed70bd ("net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()"). Fixes: ab9414ed70bd ("net: skbuff: don't leave stale bytes in skb_copy_and_= csum_bits()") Fixes: 417261779eab ("net: skbuff: don't BUG() on leftover length in skb_co= py_and_csum_bits()") Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Link: https://lore.kernel.org/all/179148235783.434549.14322374227477832817@= kernel.org/ Suggested-by: Mina Almasry Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the Reviewed-by: Mina Almasry --- drivers/net/ethernet/sun/sunvnet_common.c | 10 ++- include/linux/skbuff.h | 4 +- net/core/skbuff.c | 133 ++++++++++++++++++++------= ---- net/ipv4/icmp.c | 9 +- net/ipv4/ip_output.c | 11 ++- net/ipv6/icmp.c | 7 +- net/ipv6/ip6_output.c | 11 ++- net/sunrpc/socklib.c | 9 +- 8 files changed, 127 insertions(+), 67 deletions(-) diff --git a/drivers/net/ethernet/sun/sunvnet_common.c b/drivers/net/ethern= et/sun/sunvnet_common.c index 5cca95869052..4f229fcecc32 100644 --- a/drivers/net/ethernet/sun/sunvnet_common.c +++ b/drivers/net/ethernet/sun/sunvnet_common.c @@ -1167,9 +1167,13 @@ static inline struct sk_buff *vnet_skb_shape(struct = sk_buff *skb, int ncookies) =20 /* copy the rest, with csum calculation */ *(__sum16 *)(skb->data + offset) =3D 0; - csum =3D skb_copy_and_csum_bits(skb, start, - nskb->data + start, - skb->len - start); + if (skb_copy_and_csum_bits(skb, start, + nskb->data + start, + skb->len - start, &csum)) { + dev_kfree_skb(nskb); + dev_kfree_skb(skb); + return NULL; + } =20 /* add in the header checksums */ if (skb->protocol =3D=3D htons(ETH_P_IP)) { diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 6787fcf6ac3e..f4c092b78006 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4280,8 +4280,8 @@ void skb_free_datagram(struct sock *sk, struct sk_buf= f *skb); int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int f= lags); int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len= ); int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int = len); -__wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset, u8 *t= o, - int len); +int __must_check skb_copy_and_csum_bits(const struct sk_buff *skb, int off= set, + u8 *to, int len, __wsum *csump); int skb_splice_bits(struct sk_buff *skb, struct sock *sk, unsigned int off= set, struct pipe_inode_info *pipe, unsigned int len, unsigned int flags); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 48f676411724..4ac2b476b0a9 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3620,14 +3620,74 @@ __wsum skb_checksum(const struct sk_buff *skb, int = offset, int len, __wsum csum) } EXPORT_SYMBOL(skb_checksum); =20 -/* Both of above in one bottle. */ +/* The frag_list part of skb_copy_and_csum_bits(). It's out of line so th= at + * taking the address of csum2 doesn't cost every caller a stack protector. + */ +static noinline int skb_copy_and_csum_frag_list(const struct sk_buff *skb, + int start, int offset, u8 *to, + int len, int pos, __wsum csum, + __wsum *csump) +{ + struct sk_buff *frag_iter; + int copy, err; =20 -__wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset, - u8 *to, int len) + skb_walk_frags(skb, frag_iter) { + __wsum csum2; + int end; + + WARN_ON(start > offset + len); + + end =3D start + frag_iter->len; + copy =3D end - offset; + if (copy > 0) { + if (copy > len) + copy =3D len; + err =3D skb_copy_and_csum_bits(frag_iter, offset - start, + to, copy, &csum2); + if (err) { + /* The child zeroed its part; zero the rest. */ + memset(to + copy, 0, len - copy); + return err; + } + csum =3D csum_block_add(csum, csum2, pos); + len -=3D copy; + if (len =3D=3D 0) + goto out; + offset +=3D copy; + to +=3D copy; + pos +=3D copy; + } + start =3D end; + } + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + /* Don't hand the caller a buffer with stale bytes in it. */ + if (len > 0) + memset(to, 0, len); + return -EFAULT; + } +out: + *csump =3D csum; + return 0; +} + +/** + * skb_copy_and_csum_bits - copy data out of an skb and checksum it + * @skb: source buffer + * @offset: offset in @skb to start copying from + * @to: destination buffer + * @len: number of bytes to copy + * @csump: where to store the checksum of the copied bytes + * + * Return: 0 on success, or -EFAULT if @skb has unreadable frags or runs + * out before @len does. On failure *@csump is not set and the part of + * @to that couldn't be filled is zeroed. + */ +int skb_copy_and_csum_bits(const struct sk_buff *skb, int offset, + u8 *to, int len, __wsum *csump) { int start =3D skb_headlen(skb); int i, copy =3D start - offset; - struct sk_buff *frag_iter; int pos =3D 0; __wsum csum =3D 0; =20 @@ -3638,7 +3698,7 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *s= kb, int offset, csum =3D csum_partial_copy_nocheck(skb->data + offset, to, copy); if ((len -=3D copy) =3D=3D 0) - return csum; + goto out; offset +=3D copy; to +=3D copy; pos =3D copy; @@ -3648,7 +3708,7 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *s= kb, int offset, /* Don't hand the caller a buffer with stale bytes in it. */ if (len > 0) memset(to, 0, len); - return 0; + return -EFAULT; } =20 for (i =3D 0; i < skb_shinfo(skb)->nr_frags; i++) { @@ -3680,43 +3740,18 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff = *skb, int offset, } =20 if (!(len -=3D copy)) - return csum; + goto out; offset +=3D copy; to +=3D copy; } start =3D end; } =20 - skb_walk_frags(skb, frag_iter) { - __wsum csum2; - int end; - - WARN_ON(start > offset + len); - - end =3D start + frag_iter->len; - if ((copy =3D end - offset) > 0) { - if (copy > len) - copy =3D len; - csum2 =3D skb_copy_and_csum_bits(frag_iter, - offset - start, - to, copy); - csum =3D csum_block_add(csum, csum2, pos); - if ((len -=3D copy) =3D=3D 0) - return csum; - offset +=3D copy; - to +=3D copy; - pos +=3D copy; - } - start =3D end; - } - if (unlikely(len)) { - DEBUG_NET_WARN_ON_ONCE(1); - /* Don't hand the caller a buffer with stale bytes in it. */ - if (len > 0) - memset(to, 0, len); - return 0; - } - return csum; + return skb_copy_and_csum_frag_list(skb, start, offset, to, len, pos, + csum, csump); +out: + *csump =3D csum; + return 0; } EXPORT_SYMBOL(skb_copy_and_csum_bits); =20 @@ -4001,9 +4036,15 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb= , u8 *to) skb_copy_from_linear_data(skb, to, csstart); =20 csum =3D 0; - if (csstart !=3D skb->len) - csum =3D skb_copy_and_csum_bits(skb, csstart, to + csstart, - skb->len - csstart); + if (csstart !=3D skb->len && + skb_copy_and_csum_bits(skb, csstart, to + csstart, + skb->len - csstart, &csum)) { + /* Send zeroes rather than intact headers on a payload that + * couldn't be copied. + */ + memset(to, 0, skb->len); + return; + } =20 if (skb->ip_summed =3D=3D CHECKSUM_PARTIAL) { long csstuff =3D csstart + skb->csum_offset; @@ -5057,11 +5098,13 @@ struct sk_buff *skb_segment(struct sk_buff *head_sk= b, if (!csum) { if (!nskb->remcsum_offload) nskb->ip_summed =3D CHECKSUM_NONE; - SKB_GSO_CB(nskb)->csum =3D - skb_copy_and_csum_bits(head_skb, offset, - skb_put(nskb, - len), - len); + if (skb_copy_and_csum_bits(head_skb, offset, + skb_put(nskb, len), + len, + &SKB_GSO_CB(nskb)->csum)) { + err =3D -EFAULT; + goto err; + } SKB_GSO_CB(nskb)->csum_start =3D skb_headroom(nskb) + doffset; } else { diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 90c0e22c29be..35008785e3d2 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -364,12 +364,15 @@ static int icmp_glue_bits(void *from, char *to, int o= ffset, int len, int odd, DEFINE_RAW_FLEX(struct icmp_bxm, icmp_param, replyopts.opt.__data, IP_OPTIONS_DATA_FIXED_SIZE); __wsum csum; + int err; =20 icmp_param =3D from; =20 - csum =3D skb_copy_and_csum_bits(icmp_param->skb, - icmp_param->offset + offset, - to, len); + err =3D skb_copy_and_csum_bits(icmp_param->skb, + icmp_param->offset + offset, + to, len, &csum); + if (err) + return err; =20 skb->csum =3D csum_block_add(skb->csum, csum, odd); if (icmp_param->data.icmph.type <=3D NR_ICMP_TYPES && diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 3396f177a18d..f7da4538d05b 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1162,9 +1162,14 @@ static int __ip_append_data(struct sock *sk, data +=3D fragheaderlen + exthdrlen; =20 if (fraggap) { - skb->csum =3D skb_copy_and_csum_bits( - skb_prev, maxfraglen, - data + transhdrlen, fraggap); + if (skb_copy_and_csum_bits(skb_prev, maxfraglen, + data + transhdrlen, + fraggap, + &skb->csum)) { + err =3D -EFAULT; + kfree_skb(skb); + goto error; + } skb_prev->csum =3D csum_sub(skb_prev->csum, skb->csum); data +=3D fraggap; diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c index a95b0351824f..31ca3da80b1f 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c @@ -322,9 +322,12 @@ static int icmpv6_getfrag(void *from, char *to, int of= fset, int len, int odd, st struct icmpv6_msg *msg =3D (struct icmpv6_msg *) from; struct sk_buff *org_skb =3D msg->skb; __wsum csum; + int err; =20 - csum =3D skb_copy_and_csum_bits(org_skb, msg->offset + offset, - to, len); + err =3D skb_copy_and_csum_bits(org_skb, msg->offset + offset, + to, len, &csum); + if (err) + return err; skb->csum =3D csum_block_add(skb->csum, csum, odd); if (!(msg->type & ICMPV6_INFOMSG_MASK)) nf_ct_attach(skb, org_skb); diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 25fe0ba98b1a..d259e7dca8ba 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1724,9 +1724,14 @@ static int __ip6_append_data(struct sock *sk, skb->transport_header =3D (skb->network_header + fragheaderlen); if (fraggap) { - skb->csum =3D skb_copy_and_csum_bits( - skb_prev, maxfraglen, - data + transhdrlen, fraggap); + if (skb_copy_and_csum_bits(skb_prev, maxfraglen, + data + transhdrlen, + fraggap, + &skb->csum)) { + err =3D -EFAULT; + kfree_skb(skb); + goto error; + } skb_prev->csum =3D csum_sub(skb_prev->csum, skb->csum); data +=3D fraggap; diff --git a/net/sunrpc/socklib.c b/net/sunrpc/socklib.c index d8d8842c7de5..5d780ad4ae3a 100644 --- a/net/sunrpc/socklib.c +++ b/net/sunrpc/socklib.c @@ -49,7 +49,9 @@ xdr_skb_read_bits(struct xdr_skb_reader *desc, void *to, = size_t len) if (desc->need_checksum) { __wsum csum; =20 - csum =3D skb_copy_and_csum_bits(desc->skb, desc->offset, to, len); + if (unlikely(skb_copy_and_csum_bits(desc->skb, desc->offset, + to, len, &csum))) + return 0; desc->csum =3D csum_block_add(desc->csum, csum, desc->offset); } else { if (unlikely(skb_copy_bits(desc->skb, desc->offset, to, len))) @@ -142,11 +144,6 @@ int csum_partial_copy_to_xdr(struct xdr_buf *xdr, stru= ct sk_buff *skb) desc.csum =3D csum_partial(skb->data, desc.offset, skb->csum); if (xdr_partial_copy_from_skb(xdr, &desc) < 0) return -1; - if (desc.offset !=3D skb->len) { - __wsum csum2; - csum2 =3D skb_checksum(skb, desc.offset, skb->len - desc.offset, 0); - desc.csum =3D csum_block_add(desc.csum, csum2, desc.offset); - } if (desc.count) return -1; if (csum_fold(desc.csum)) --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672967; cv=none; d=zohomail.com; s=zohoarc; b=F/7/chNdjKpvIhSPXlj+lTIrcAHA6b1PyKw3NcCQhHs7aGOz6d5BRg5qT6DbBNZLqkQXT9lt36UysHhIf3ABZTuasTkW8fKDjwoXOyGFt2Y6R0fJMxejSnPDYy5Gex0MsNZFsCg9alZxvyZx6i07tKPcSB8znSIVH8gwAtGOU1U= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672967; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=+ozleYq79PAzQSOQnNjxaTI69FhB0adJYpSCNMdxkqo=; b=VIKuL1lzsbSsVeStvfRejIQg9jrQYBb1RFLDe4wm2gM8JzuK+mmki2hUWfTvOYQUwkV2nbQ2m6XgNT8mbQ/PfXxsSrpMK/1DjmWc3KCl1o0+Kgwe2scPTB01YQhHw1erKCAlyLU7ABaTagwMuINXuUr/bB8Lau/vVojObTQyK0I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672967730576.7071411146125; Mon, 2 Nov 2026 18:29:27 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468931.1677934 (Exim 4.92) (envelope-from ) id 1xO4Gb-000784-Cr; Tue, 03 Nov 2026 02:28:53 +0000 Received: by outflank-mailman (output) from mailman id 1468931.1677934; Tue, 03 Nov 2026 02:28:53 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gb-00077x-AH; Tue, 03 Nov 2026 02:28:53 +0000 Received: by outflank-mailman (input) for mailman id 1468931; Tue, 03 Nov 2026 02:28:51 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4GZ-0006y7-J7 for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:28:51 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4GZ-00CYCC-0A for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:28:51 +0100 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae94690-e002-0a2a0a5209dd-0a2a450cec40-12 for ; Tue, 03 Nov 2026 03:28:50 +0100 Received: from [209.85.160.180] (helo=mail-qt1-f180.google.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946e1-f479-0a2a450c0019-d155a0b4ac6d-3 for ; Tue, 03 Nov 2026 03:28:50 +0100 Received: by mail-qt1-f180.google.com with SMTP id d75a77b69052e-5363c8de563so45361171cf.0 for ; Mon, 02 Nov 2026 18:28:50 -0800 (PST) Received: from toxicpanda.com ([153.61.196.254]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5498b49dcbasm13852001cf.6.2026.11.02.18.28.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:28:48 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672929; x=1794277729; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+ozleYq79PAzQSOQnNjxaTI69FhB0adJYpSCNMdxkqo=; b=pYzibUXI1/oW5S55eD6PggpE28QTzPpONH/OD5Ss/E5yD8cTVAy8JFC58b/XXuhtCq vz+Gdw4xp0HX3tFzzpZdzd+RzFmrX902jrF0lgZcRPIW/4rYTcjVKlBZ2nFVZiajyplK Ex1LP611Y4oChvBi5lTVOxnNonknTQiNk0otv2PosX751dqVO9OUWdTT9aTKK570oobJ DTBXIJ7lSIUPGS7jDYbLDVmGkc3OnnO6cN4w6pUl4ga8Oa8a93Lw+3HnNTYN/dDi/E14 FGcRpF/aSKAY13YOhExfl1HG9OHuis9f2BfgRTwVh7l7x/otsO0ySJzCIvblKP+MAtTh 21dA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672929; x=1794277729; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+ozleYq79PAzQSOQnNjxaTI69FhB0adJYpSCNMdxkqo=; b=mfC9m6VyXXWOzTJrM1doxVP+O/0CSRAwErk1WBzUX3iNzk6jnDdHiBQYtTD2HVrcoK 3uwo+UD8kTsk2S6r4Eix165HxXLwkkOXKycI01MzPWUbTfSV8TdZePOdv6lpCOwfORw2 7DA6uaR2svuLFPqlm9c6DqA6g5SJyM6aX7AuBPkzAXG1fMUkkxhbH1PZOzSPhQWkkk3R 6xRyOaZL6EB3Om2bOLtHeyQvcGYakCB8yEe/SgobyUk1vl9mws493MLyF25sbgLGUfn8 K7Abdzu+/tWpoOQD1xMEP/zLQJCpmYW6hSOrNLiSHH44DF+CN0PuN/h+W9v2+j9cuJuX KJIw== X-Forwarded-Encrypted: i=1; AKwUvBwiXTNUYpc1Bpz2K9omtTwN7ZYd4hpD3ZG3ki96GS9tUlUYp2pOOgqykXmJDYIHeT3M6f3yuRIeENE=@lists.xenproject.org X-Gm-Message-State: AFq9FYJv4PR+/Lmrr3Y7fm2VkfvRW2COtMQ3G23dpcOOS5UNsGO8S7Vn 0p1S8/OSmQMWh+JM+4/YyVLMbCKQnQJXim89GbTfDoYAfoPu3P20Y4A0mI+KtxOJtJQ= X-Gm-Gg: AYBFou3ePdJnetbUbuv2SsuwxWgA9/KY9GQhGukTqAycupeFpJUb4VaNgjq4GJ80J21 i+AOB+7CqG/fxUnHu4vDN+R4Z6plp5/Tk7vjw0f0E3Z8G/p3ZF0oq1kfqRxwnesiVOT1lw5vpnW w6/G8aNoU30Dphe3+QZCWPxHFGKtoI+SRtxvVUi0N+o8MNJ2KWy+vNzhEqB1S8f7vjSgZEGBt1i K3wmzTCBYTtRl04SICB4MyaDmRJIGmNQ/KDPnepS5/FgzJdw8OGnNiJw4Beak0Xp64JASVT73cA me6jcJjWDOO3xAYtQXJAf7pRFpvo59SDmQMy5aVf8OU279/VQtASEVrAwQdbhrD6J7zLrXzzkcg Hnz2ZRlS5mF3Ykib/q5eFxpZCrN9rQUlLbMtJtv8STEVdgL+KPEbc7vff3NjDWvdfyiWmjwimWT NZesJ7hfrINc93jcatjFw7HYzTwl5+ZCKfqZLTjNmtD3XeqRlypimoyPPedIui6kUihx1gWmceo quLpnNvvXlTFfxhzVC3T7qfwma/Md52sRWh97QABo6EfTUeYVv2t3nKDr4gFhBIa+wSytLK3s59 O3Z9yLVz+7HbRT43u2xBGl/w9w7Ttpq+1gu/x4kpPwNOdw== X-Received: by 2002:a05:622a:5a18:b0:535:1f5c:e489 with SMTP id d75a77b69052e-542b3c7654amr201014651cf.5.1793672929169; Mon, 02 Nov 2026 18:28:49 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:28 +0000 Subject: [PATCH net-next v3 02/15] net: skbuff: add skb_checksum_full() that reports failure MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-2-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672922; l=7462; i=josef@toxicpanda.com; h=from:subject:message-id; bh=iRXaavMuCCaIGwQeEKD5PODE5O9BI1CI4qAS/RRmb+g=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QFbzfrMZOtH7r3Qw/39UwgOlx0VaLuRXbKWQmLqAJvZ0BPoJPrHv+hz+CnhxLSOHCSomsdC80Mi ocS25mNUyyQs= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d25034/1793672930-51936A5B-BF37BC5E/0/0 X-purgate-type: clean X-purgate-size: 7464 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672969903158500 skb_checksum() can't fail. When the range runs into unreadable frags or past the end of the skb, skb_checksum() returns 0, which is also a valid checksum, so its callers can't tell a sum from a failure. Add skb_checksum_full(), which adds the range's sum to *@csump and returns 0. On failure it leaves *@csump alone and returns -EFAULT, or -EINVAL for a negative length. It is __must_check. Its frag_list loop sits in a noinline function so that taking the address of a local doesn't give skb_checksum_full() a stack protector. skb_checksum() becomes a wrapper for the callers that aren't converted yet, and still returns 0 on failure. Three things change for them: - When a frag_list member fails, skb_checksum() returns 0 for the whole range instead of the sum of the parts it could read. Neither value is the checksum of the range. - skb_checksum() only warns about unreadable frags if @skb itself has them. - A negative length returns 0 instead of reaching csum_partial(). Convert skb_checksum_help(), which can already return an error, so that a packet that can't be checksummed is dropped instead of sent with a wrong checksum. The following patches convert checksum validation, skb_segment() and pskb_trim_rcsum(). The rest will follow per subsystem. Fixes: 20ddd0fd2fcd ("net: skbuff: don't BUG() on leftover length in skb_ch= ecksum() and friends") Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- include/linux/skbuff.h | 2 + net/core/dev.c | 7 +++- net/core/skbuff.c | 111 ++++++++++++++++++++++++++++++++++++---------= ---- 3 files changed, 90 insertions(+), 30 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index f4c092b78006..608c1491597e 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4282,6 +4282,8 @@ int skb_copy_bits(const struct sk_buff *skb, int offs= et, void *to, int len); int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int = len); int __must_check skb_copy_and_csum_bits(const struct sk_buff *skb, int off= set, u8 *to, int len, __wsum *csump); +int __must_check skb_checksum_full(const struct sk_buff *skb, int offset, + int len, __wsum *csump); int skb_splice_bits(struct sk_buff *skb, struct sock *sk, unsigned int off= set, struct pipe_inode_info *pipe, unsigned int len, unsigned int flags); diff --git a/net/core/dev.c b/net/core/dev.c index 3ac700d37e59..00a62c391056 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3665,7 +3665,7 @@ void skb_warn_bad_offload(const struct sk_buff *skb) */ int skb_checksum_help(struct sk_buff *skb) { - __wsum csum; + __wsum csum =3D 0; int ret =3D 0, offset; =20 if (skb->ip_summed =3D=3D CHECKSUM_COMPLETE) @@ -3697,13 +3697,16 @@ int skb_checksum_help(struct sk_buff *skb) offset, skb_headlen(skb)); goto out; } - csum =3D skb_checksum(skb, offset, skb->len - offset, 0); + ret =3D skb_checksum_full(skb, offset, skb->len - offset, &csum); + if (ret) + goto out; =20 offset +=3D skb->csum_offset; if (unlikely(offset + sizeof(__sum16) > skb_headlen(skb))) { DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false); WARN_ONCE(true, "offset+2 (%zu) > skb_headlen() (%u)\n", offset + sizeof(__sum16), skb_headlen(skb)); + ret =3D -EINVAL; goto out; } ret =3D skb_ensure_writable(skb, offset + sizeof(__sum16)); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 4ac2b476b0a9..c5f8aca89221 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3536,27 +3536,88 @@ int skb_store_bits(struct sk_buff *skb, int offset,= const void *from, int len) } EXPORT_SYMBOL(skb_store_bits); =20 -/* Checksum skb data. */ -__wsum skb_checksum(const struct sk_buff *skb, int offset, int len, __wsum= csum) +/* The frag_list part of skb_checksum_full(). It's out of line so that ta= king + * the address of csum2 doesn't cost every caller a stack protector. + */ +static noinline int skb_checksum_frag_list(const struct sk_buff *skb, int = start, + int offset, int len, int pos, + __wsum csum, __wsum *csump) +{ + struct sk_buff *frag_iter; + int copy, err; + + skb_walk_frags(skb, frag_iter) { + int end; + + WARN_ON(start > offset + len); + + end =3D start + frag_iter->len; + copy =3D end - offset; + if (copy > 0) { + __wsum csum2 =3D 0; + + if (copy > len) + copy =3D len; + err =3D skb_checksum_full(frag_iter, offset - start, copy, + &csum2); + if (err) + return err; + csum =3D csum_block_add(csum, csum2, pos); + len -=3D copy; + if (len =3D=3D 0) + goto out; + offset +=3D copy; + pos +=3D copy; + } + start =3D end; + } + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EFAULT; + } +out: + *csump =3D csum; + return 0; +} + +/** + * skb_checksum_full - checksum a range of an skb + * @skb: buffer to checksum + * @offset: offset in @skb to start at + * @len: number of bytes to checksum + * @csump: the sum to add to; on success the range's sum is added to it + * + * Return: 0 on success, -EINVAL if @len is negative, or -EFAULT if @skb + * runs out before @len does, or if the range goes past the linear area + * of an skb, @skb or one on its frag_list, that has unreadable frags. + * On failure *@csump is not changed. + */ +int skb_checksum_full(const struct sk_buff *skb, int offset, int len, + __wsum *csump) { int start =3D skb_headlen(skb); int i, copy =3D start - offset; - struct sk_buff *frag_iter; + __wsum csum =3D *csump; int pos =3D 0; =20 + if (unlikely(len < 0)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } + /* Checksum header. */ if (copy > 0) { if (copy > len) copy =3D len; csum =3D csum_partial(skb->data + offset, copy, csum); if ((len -=3D copy) =3D=3D 0) - return csum; + goto out; offset +=3D copy; pos =3D copy; } =20 - if (WARN_ON_ONCE(!skb_frags_readable(skb))) - return 0; + if (!skb_frags_readable(skb)) + return -EFAULT; =20 for (i =3D 0; i < skb_shinfo(skb)->nr_frags; i++) { int end; @@ -3585,37 +3646,31 @@ __wsum skb_checksum(const struct sk_buff *skb, int = offset, int len, __wsum csum) } =20 if (!(len -=3D copy)) - return csum; + goto out; offset +=3D copy; } start =3D end; } =20 - skb_walk_frags(skb, frag_iter) { - int end; + return skb_checksum_frag_list(skb, start, offset, len, pos, csum, + csump); +out: + *csump =3D csum; + return 0; +} +EXPORT_SYMBOL(skb_checksum_full); =20 - WARN_ON(start > offset + len); +/* skb_checksum() has no way to report failure, so it returns 0, which is a + * valid checksum. Use skb_checksum_full() in new code. + */ +__wsum skb_checksum(const struct sk_buff *skb, int offset, int len, __wsum= csum) +{ + int err =3D skb_checksum_full(skb, offset, len, &csum); =20 - end =3D start + frag_iter->len; - if ((copy =3D end - offset) > 0) { - __wsum csum2; - if (copy > len) - copy =3D len; - csum2 =3D skb_checksum(frag_iter, offset - start, copy, - 0); - csum =3D csum_block_add(csum, csum2, pos); - if ((len -=3D copy) =3D=3D 0) - return csum; - offset +=3D copy; - pos +=3D copy; - } - start =3D end; - } - if (unlikely(len)) { - DEBUG_NET_WARN_ON_ONCE(1); + if (unlikely(err)) { + WARN_ON_ONCE(err =3D=3D -EFAULT && !skb_frags_readable(skb)); return 0; } - return csum; } EXPORT_SYMBOL(skb_checksum); --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672957; cv=none; d=zohomail.com; s=zohoarc; b=DaT5tdXyjJQ54Dqi/MKz9Hhjvjuw0LzcCjoUxueTNnujuWLQunFMxqLayrsIAdN9lOL34dvRLZlfurnEt7xDa+vQpjw/yp09ZjUZDZrWiEiW+Fs13K7TlvA2tauVZ5J+IfHcd5ewGl0cTF/MKPsTM7RE1LuqAChiG46BudH7z+0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672957; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=E+PueQRw3LXmq/KAZXUuB8w4RjwHTCemS7p7oseT8Jo=; b=MLZ+cBO0B03+6Co+Qatd2ML3dvdVn3IKRden347cIOAHMA8okBRScFOqG3lTJ8NyPhFSosJ5+B2SNJWsN3KLH+dFNqN7E2hX9h3ZxpI238E2pa5u+vNESNRs4eL7Sbs+be2BdlwdVZmVUW0B7IRg9vuYN0Fb5lv/2hw30b0ajuY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672957587561.4849331788372; Mon, 2 Nov 2026 18:29:17 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468932.1677943 (Exim 4.92) (envelope-from ) id 1xO4Gc-0007Ll-PD; Tue, 03 Nov 2026 02:28:54 +0000 Received: by outflank-mailman (output) from mailman id 1468932.1677943; Tue, 03 Nov 2026 02:28:54 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gc-0007Le-L7; Tue, 03 Nov 2026 02:28:54 +0000 Received: by outflank-mailman (input) for mailman id 1468932; Tue, 03 Nov 2026 02:28:53 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gb-000787-OY for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:28:53 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Ga-00143l-VC for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:28:52 +0100 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae946b5-2eae-0a2a0a5409dd-0a2a4501bef4-16 for ; Tue, 03 Nov 2026 03:28:52 +0100 Received: from [209.85.160.169] (helo=mail-qt1-f169.google.com) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946e3-5984-0a2a45010019-d155a0a9e4fe-3 for ; Tue, 03 Nov 2026 03:28:52 +0100 Received: by mail-qt1-f169.google.com with SMTP id d75a77b69052e-53cd0c8614eso28049931cf.0 for ; Mon, 02 Nov 2026 18:28:52 -0800 (PST) Received: from toxicpanda.com ([153.61.196.254]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5498b49ce1dsm13809921cf.5.2026.11.02.18.28.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:28:50 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672931; x=1794277731; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=E+PueQRw3LXmq/KAZXUuB8w4RjwHTCemS7p7oseT8Jo=; b=nMO7wOwVEBQ28ZR4iEZBZHbwYWGnZNMCDintQGg4X98+nHeiCStxLW2eMAttBvsNsE t9h7XjH//uSJEMDyVbVayaxJMw9/TiH9AUffhGuKSuF46Dq30L9q635mR9JUaYQpW/pc OIjUSDPtD804GFu/Mcd7Ihwb1J0wWz/OI+pEUyWBf49gXTctZmydSBjMoHM2z59ZGRTy mD4G4uZEV8vRDtAftDZXz0O7ND7E/2Uk+NcG21P9pqr+MVcOlrNeoSU9Vi6W+/BR6gM3 EvgEEVyq6iiTnZxC1GZIf5CTKu8Jv0zhJuU1liWs1AjaXjnxjJm0F0BSMskOWlY+Rzqw yXTA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672931; x=1794277731; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=E+PueQRw3LXmq/KAZXUuB8w4RjwHTCemS7p7oseT8Jo=; b=oLqKbM4PQx0qCgGeOtiAAz6eL40tsOnG3GxmpbwMWhPwlzYdcngzcFaOG3A5Wbz2Md tBW15yqP7WQ0u1d5fMXFEUPUPmrjQOOarcm04UyZFhajhOZu71tzmjsUpu/Pi+7BJ9Ar DVskmGq3G73vdcFi6VjIeT12Mz69sxrgEiYWz/lsMfEagn/eUCeoYx8oyOEdaNlyun1K Ye4Fi7Fkh9yKLJTgX/DTStcVBeN4vcg5M83GbUSHcLsMYehP+puqqE1Yq5otgBaYF6Q+ 3efr4xX5dfrqtzaPYMpouk2c9XMPJpP2idPzuBqnhrNqqlgX2LTUGQqtPClylLDtoGuw sb1w== X-Forwarded-Encrypted: i=1; AKwUvBy1N0y4qDsTtzAsS5eEIckZPQDQkpOjmlzNLlG3eNRA5ZeVz8SFF8ayqbSMhER2tRdMYCw9tto1eKk=@lists.xenproject.org X-Gm-Message-State: APuU4Z/HG97MJxROjLgmpoa6htO7mrUNZqCHXKGmczIC4HGYkOxJFx3F Ogblkli1kvLv9tC7zRIgjnjYQx9NTrjetXeBCByi+BJMYl886g4Oy5iRkQYzOu1n7lI= X-Gm-Gg: AYBFou2UoIZL2GIZtyz9BCsliEOO1LBCnfdEORG4UJPMYwASs9vUmuvgfF6VwmopR28 ELTMRcechiCl9PgOvLcezh2S2bQTFD2g8zbLEdIs2WJBSm0vyiyBuqG9Y/GNp3s+/8ISQjZOq2a Gb7zeoC289T0p73eXkjKnFSAPQ2/+PTme2I0xXoGWLGv3COikr6Tbyv+DxE1JZUA8dqZ47pWBjY rcU7LUTkaywjBAj0NhTsIdXF1V4W3D55uyuL/PddVoQRerIuwcA+G8Pno79dtm3hTnoGcOrH1Fh wHku9eJEuNkRiQq9eSxvnFvb2S3LrdOriSemQw/Bt5rvjPXABQGyMsFjEkYLZ1F1nRN/T0OBI6O qLTCSQE8s6ILKGm6C5tHdn/vcTwcrKqG41ANKPIa9Gkebr9mlkHymkWO9di3bqHdrGsPvoMgqxQ 62Xe385aFvivO6hFPACt4VaLJ01DwsqykSLftdHQ3ynvRM6VatZpVUOT49ZfYVMyABVXOeyj/Gg GMiFF/5l6YoT7cgbzwCt6bDbcOk6AQuFTEZ4VX60lvfXWuPxS88j1+5DKOCY5GI2tTW9ZuOU1JK JqdFzsf3ZbX28ZP3lqRtnySCVY6nGI8hQbOryJVay6K/7A== X-Received: by 2002:a05:622a:1c17:b0:536:622d:6932 with SMTP id d75a77b69052e-542b62a4588mr193623181cf.23.1793672931108; Mon, 02 Nov 2026 18:28:51 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:29 +0000 Subject: [PATCH net-next v3 03/15] net: skbuff: fail checksum validation when the skb can't be checksummed MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-3-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672922; l=5641; i=josef@toxicpanda.com; h=from:subject:message-id; bh=ljkKcEFWSleZcYbEYDqih3Hv4TBj+2u86MNLksCHbxQ=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QCMEGKf9eY/JjLBx3uBpM1AvSdEnm9af1QuiTOeZWeeXF3LjhcUUm3ZNvs0Y8u3YMijw2VBPR/Y U7NAKuRMA3AQ= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d62444/1793672932-BF262757-F1E2891A/0/0 X-purgate-type: clean X-purgate-size: 5643 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672959790158500 __skb_checksum_complete() and __skb_gro_checksum_complete() verify a packet with skb_checksum(), which returns 0 when the payload is in unreadable frags or the skb's lengths don't add up. Both add that 0 to the pseudo-header sum, so they accept the packet whenever the pseudo-header sum folds to 0xffff. The sender controls that sum through the addresses and the length. Use skb_checksum_full() in both, and in __skb_checksum_complete_head(), and report an skb that can't be checksummed as having a bad checksum. Also take the skb off CHECKSUM_COMPLETE on that path. nf_ip_checksum() stores the pseudo-header sum in skb->csum before it calls __skb_checksum_complete(), and conntrack doesn't drop a packet with a bad checksum. If the skb stayed CHECKSUM_COMPLETE, __skb_checksum_validate_complete() would add the same pseudo-header sum to skb->csum and accept the packet under the same condition. A test module builds an skb that claims 50 more bytes than it holds, with a pseudo-header sum of 0xffff. Both functions accept that skb before this patch and reject it after. Found by the Sashiko AI review of the BUG_ON() series. Fixes: 20ddd0fd2fcd ("net: skbuff: don't BUG() on leftover length in skb_ch= ecksum() and friends") Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f73289= 5b@toxicpanda.com/ Link: https://lore.kernel.org/all/179273111951.3134.3452028799437573017@ker= nel.org/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- include/linux/skbuff.h | 4 ++-- net/core/gro.c | 11 +++++++++-- net/core/skbuff.c | 27 +++++++++++++++++++++++---- 3 files changed, 34 insertions(+), 8 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 608c1491597e..5a5354a6b6ba 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4892,7 +4892,7 @@ static inline void skb_checksum_complete_unset(struct= sk_buff *skb) * 0: checksum is validated or try to in skb_checksum_complete. In the l= atter * case the ip_summed will not be CHECKSUM_UNNECESSARY and the pseudo * checksum is stored in skb->csum for use in __skb_checksum_complete - * non-zero: value of invalid checksum + * non-zero: value of invalid checksum, or 1 if the skb can't be checksu= mmed * */ static inline __sum16 __skb_checksum_validate_complete(struct sk_buff *skb, @@ -4932,7 +4932,7 @@ static inline __wsum null_compute_pseudo(struct sk_bu= ff *skb, int proto) * * Return values: * 0: checksum is validated or try to in skb_checksum_complete - * non-zero: value of invalid checksum + * non-zero: value of invalid checksum, or 1 if the skb can't be checksu= mmed */ #define __skb_checksum_validate(skb, proto, complete, \ zero_okay, check, compute_pseudo) \ diff --git a/net/core/gro.c b/net/core/gro.c index 1b033855a20d..e2e847c95270 100644 --- a/net/core/gro.c +++ b/net/core/gro.c @@ -798,10 +798,17 @@ EXPORT_SYMBOL(napi_gro_frags); */ __sum16 __skb_gro_checksum_complete(struct sk_buff *skb) { - __wsum wsum; + __wsum wsum =3D 0; __sum16 sum; =20 - wsum =3D skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb), 0); + /* If the data can't be checksummed it can't be valid either, and + * NAPI_GRO_CB(skb)->csum only holds the pseudo checksum. + */ + if (skb_checksum_full(skb, skb_gro_offset(skb), skb_gro_len(skb), + &wsum)) { + NAPI_GRO_CB(skb)->csum_valid =3D 0; + return (__force __sum16)1; + } =20 /* NAPI_GRO_CB(skb)->csum holds pseudo checksum */ sum =3D csum_fold(csum_add(NAPI_GRO_CB(skb)->csum, wsum)); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index c5f8aca89221..0d3f0f09c7d1 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3885,11 +3885,28 @@ u32 skb_crc32c(const struct sk_buff *skb, int offse= t, int len, u32 crc) EXPORT_SYMBOL(skb_crc32c); #endif /* CONFIG_NET_CRC32C */ =20 +/* The data can't be checksummed, so it can't be valid either. The caller= has + * put the pseudo header's checksum in skb->csum, so don't leave the skb + * CHECKSUM_COMPLETE for a later validator to take that for the packet's. + */ +static __sum16 skb_checksum_complete_failed(struct sk_buff *skb) +{ + if (!skb_shared(skb)) { + skb_checksum_complete_unset(skb); + skb->csum_valid =3D 0; + } + return (__force __sum16)1; +} + __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len) { + __wsum csum =3D skb->csum; __sum16 sum; =20 - sum =3D csum_fold(skb_checksum(skb, 0, len, skb->csum)); + if (skb_checksum_full(skb, 0, len, &csum)) + return skb_checksum_complete_failed(skb); + + sum =3D csum_fold(csum); /* See comments in __skb_checksum_complete(). */ if (likely(!sum)) { if (unlikely(skb->ip_summed =3D=3D CHECKSUM_COMPLETE) && @@ -3909,14 +3926,16 @@ EXPORT_SYMBOL(__skb_checksum_complete_head); * * It returns non-zero if the recomputed checksum is still invalid, otherw= ise * zero. The new checksum is stored back into skb->csum unless the skb is - * shared. + * shared. If the skb can't be checksummed it returns non-zero, skb->csum = is + * left alone, and the skb is no longer CHECKSUM_COMPLETE unless it's shar= ed. */ __sum16 __skb_checksum_complete(struct sk_buff *skb) { - __wsum csum; + __wsum csum =3D 0; __sum16 sum; =20 - csum =3D skb_checksum(skb, 0, skb->len, 0); + if (skb_checksum_full(skb, 0, skb->len, &csum)) + return skb_checksum_complete_failed(skb); =20 sum =3D csum_fold(csum_add(skb->csum, csum)); /* This check is inverted, because we already knew the hardware --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672958; cv=none; d=zohomail.com; s=zohoarc; b=kt4So1FUtX6DJIt6vnv4L6I111m3tVLu+ewnRo3TiStTXXi746yj7+nOx3JpFCc0FGhyW2j8yBettNk3cVK7wb+KzyaW9H1MOvivDn/OpnqDGjoqE+sHUanLHO4pu+1XBM6mRRGa+Tyw7uce5rfViWCGVAxQgMiWTUFmijhxyY4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672958; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=MLIaIMsqYL3SSjD9c7Tzup1bl56m63w7tPTiVpME7Yg=; b=CPyqY/c+woVtgYYUcT/EuMNPrZj6ekL+8cX/rvHsaJXrdH/bdsdXMiHHH0tbJf4/YPanTGnkVl8aPBIoCJ/gYKjq3RKIINOg4E4OwRGnPmLIff9JckB4YJLkzctehk5I7tXHhmAhC2qoK8AiTYCcSuJA16f724bNmBnDo231Oew= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672958310489.2747533572541; Mon, 2 Nov 2026 18:29:18 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468933.1677953 (Exim 4.92) (envelope-from ) id 1xO4Gf-0007aP-16; Tue, 03 Nov 2026 02:28:57 +0000 Received: by outflank-mailman (output) from mailman id 1468933.1677953; Tue, 03 Nov 2026 02:28:56 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Ge-0007aC-S3; Tue, 03 Nov 2026 02:28:56 +0000 Received: by outflank-mailman (input) for mailman id 1468933; Tue, 03 Nov 2026 02:28:55 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gd-0007Y3-TI for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:28:55 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gd-009OZN-9x for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:28:55 +0100 Received: from [10.42.69.5] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae946be-bab6-0a2a0a5309dd-0a2a4505c0c4-30 for ; Tue, 03 Nov 2026 03:28:55 +0100 Received: from [209.85.160.174] (helo=mail-qt1-f174.google.com) by tlsNG-c201ff.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946e6-4cb1-0a2a45050019-d155a0aed967-3 for ; Tue, 03 Nov 2026 03:28:55 +0100 Received: by mail-qt1-f174.google.com with SMTP id d75a77b69052e-533778ab0bdso53014981cf.3 for ; Mon, 02 Nov 2026 18:28:54 -0800 (PST) Received: from toxicpanda.com ([153.61.196.245]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5498cb5b520sm13795611cf.26.2026.11.02.18.28.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:28:53 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672934; x=1794277734; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MLIaIMsqYL3SSjD9c7Tzup1bl56m63w7tPTiVpME7Yg=; b=cQ1AD9RFI5MMhd69Vs4KeN8xN0dL78XDJUlLftISHy07IYPFD9PTwwKycNYg6IDg4S Jpt9mwSKwo2Guv+iWkccLKQOjvAumsveKeohYXn6sssBbLtIuCMA3Asg3tR+akw2QbPV AmA6smt0XrV+g48fmRJxkxi/f0Z2reEsuRwAz/h2sFw9vjuneeN+inpW54Ntyq1YRECY qh+OXdUvYyLzYWp/rvAvmlpVuT0Hi4cuCO1ikO3bY8wzlY5AM9q88h8OITPRK1eZJnj1 LDKs5uxQHNWyEJwr0WjAfyd6NPjZRAq+0TzhIBgB8t9wOiFmDZPlMQLTmjETK61AeNK0 6Sbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672934; x=1794277734; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=MLIaIMsqYL3SSjD9c7Tzup1bl56m63w7tPTiVpME7Yg=; b=sfzRnjJhcw5huvGQ+aWmmN1gFChQ+bzoevC/PepRHI7zVinSNFvQdRTvR1GrW7EyMZ fvQmi5AVmcFVTR6i5GxUkZFLFFa1lnwvOLgsSIdXbCZ60Fo0QTkHvN/DlS9y14OtogSN vJ3JfVlmCvLz6nBnHB8DRmOSFLDH5Tcn2bRmaCF165/SK4+VZroZan5gKQzHnJOVpJDi bGTuRd1z3eZ5l7jAPxp3A4vz4OjMW222c73V9EG+HbY9VjvNH7Se7AuXGYkmjw37fQjT czrhPaQDC9ilTUsvpsYgGcyZl8poIX5GjjwYCTwdCmCqVSs85paj1XfHmJJUMSYfIigK UL0Q== X-Forwarded-Encrypted: i=1; AKwUvBxXOdp+V1C9PsIRLyZJUL6l/Macxn07lRxhVpbL3DBJpDgL/G/ZtLQKQMBEJT2dWRuNE1THZBdMzbc=@lists.xenproject.org X-Gm-Message-State: AFq9FYJzzFGRSyIM1Yk0dAQEUX6vnF23gx9xhscmKPNTWDIsFna6FDYF 2hMuhd3zTmNYt3Wpz2LPhW34swpSZnfOj7LZ8eH0NR8KYrfwf4NhTjxpAvLjJICdSgU= X-Gm-Gg: AYBFou3/iuHSAz7dkNZpxAvXMF6taEsSkJkhdRqnwR/GfV8RFx7FR1eYjcVs5NAYGLf elFHkhXqqqMyaVzCSba/ekk7OBF40s+zIr+1skSnd0PkMJmnQVHMNdQ0tIf3trxxV6tyvU6f1rI JnMZuJk8uUmthdDeCJWkEP0I9LVxIeeTAAHZXf0QblDJ7SiRdr+VebXdY7Y8Xa2shdmHKSg3Mrr PltwXs77g1zaY60zRy3i2ti+fHgV3M3olU1zKhMexXfZ4f9It5fnVZnatcKwENvBiiqc3wExKjB EhhomRJ2Kyjten73CUY7Q405KpCKF/qBdZ5dU+NmtHmdtz3pboYY7kjSBCmLa6QDDiqhMijHp8r Zhauf3JdRYjecZpm3E92v1i+Jg4L6yPdZG1pQWKFC2JWqnh8xhAFFPZATMIW/V4bxaor5Q+B6p2 nBMx4eplBdLozCw3jDXefFe9iXO/W/3v8WBcGDKRa+ScjQPix3szfkojn9oQr6ndW4tj4VpHebW ulPrNtRM3mnZ6ik99dFoyOL3YeYGKWBgcV9AUKwJ4mDD6r7kdjhQTeuv9RHKaDPZeeXBFHNz9m3 zFxf4yd8uhiBdwCmqQN4dOU8rTNbswCVAeG4LyNuvzypYQ== X-Received: by 2002:a05:622a:a889:b0:537:83e9:b88a with SMTP id d75a77b69052e-542b64964b4mr199343741cf.23.1793672933851; Mon, 02 Nov 2026 18:28:53 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:30 +0000 Subject: [PATCH net-next v3 04/15] net: skbuff: fail segmentation when a segment can't be checksummed MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-4-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672922; l=1748; i=josef@toxicpanda.com; h=from:subject:message-id; bh=TlO/AKeZArxeBmRh7l805X0/4fVE3bHDKuOYPc0A/+Y=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QDNO9/a3hdew67VlcDguwy5iB/P7gwRmhlzB8AVvniMlDrIfyz9W9B22je1YjbgzdeslLLgxJZL 0BnXxMWLQxws= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-c201ff/1793672935-F6CB02A1-DEA0FD69/0/0 X-purgate-type: clean X-purgate-size: 1750 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672959746158500 When the device can't checksum the protocol, skb_segment() checksums each segment with skb_checksum(). If the segment has unreadable frags, or its lengths don't add up, skb_checksum() returns 0 and the segment goes out with a checksum that doesn't cover its payload. Devmem TCP doesn't get that far today. Its skbs take SKBFL_SHARED_FRAG from the zerocopy uarg, so skb_segment() tries to linearize the segment first, and that fails with -ENOMEM for unreadable frags. No other path is known to bring an unreadable segment here either. Use skb_checksum_full() and fail the segmentation with -EFAULT, so that the checksum doesn't depend on that flag. Found by the Sashiko AI review of an earlier fix for the same path with SG off. Link: https://lore.kernel.org/all/20261009-b4-skb-segment-nosg-unreadable-v= 1-1-7e2334a55fe8@toxicpanda.com/ Reviewed-by: Fernando Fernandez Mancera Signed-off-by: Josef Bacik Acked-by: Mina Almasry Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 0d3f0f09c7d1..5f997edf3519 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5292,9 +5292,13 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, =20 if (!nskb->remcsum_offload) nskb->ip_summed =3D CHECKSUM_NONE; - SKB_GSO_CB(nskb)->csum =3D - skb_checksum(nskb, doffset, - nskb->len - doffset, 0); + SKB_GSO_CB(nskb)->csum =3D 0; + if (skb_checksum_full(nskb, doffset, + nskb->len - doffset, + &SKB_GSO_CB(nskb)->csum)) { + err =3D -EFAULT; + goto err; + } SKB_GSO_CB(nskb)->csum_start =3D skb_headroom(nskb) + doffset; } --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672953; cv=none; d=zohomail.com; s=zohoarc; b=i0a+8ISHeflUEecRUiqIziIN1AN5GOjlNkzeKsKf/uUY8gbejHQq4tYSvBfs2bpGG2fr5fon5l2Kc2D/eN63HCciO6tRsvq0coxZQBBltmivBgByRCGckDJbXQBDUXkYkSxLM8PZ8hL5zbhIlbxYFOHHpRRIdyLvpT5ZC6YD0+k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672953; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=sPhoPgLC+8GlCU41+5ydGuziU72t8bYzLKeHnMqsGwE=; b=f+vig5ks2fBCYm4YL7DToY+6EdodFyTNP1QelTQiXDg1nPr2XBHW3RIPSDtkWpManY81uix4JPtRxeZAh6Usc7S2lLJOFUhacKAjWv254AiSkJaVQmux1DVs4JoKjoWF3oD4MWVcU06WINiJE5YTJ5Yor0SiHoLoFO/GlN14w38= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672953499399.7755549598619; Mon, 2 Nov 2026 18:29:13 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468934.1677962 (Exim 4.92) (envelope-from ) id 1xO4Gh-0007qQ-91; Tue, 03 Nov 2026 02:28:59 +0000 Received: by outflank-mailman (output) from mailman id 1468934.1677962; Tue, 03 Nov 2026 02:28:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gh-0007qJ-4T; Tue, 03 Nov 2026 02:28:59 +0000 Received: by outflank-mailman (input) for mailman id 1468934; Tue, 03 Nov 2026 02:28:57 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gf-0007jR-QR for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:28:57 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gf-009OZN-7M for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:28:57 +0100 Received: from [10.42.69.5] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae946be-bab6-0a2a0a5309dd-0a2a4505c0c4-32 for ; Tue, 03 Nov 2026 03:28:57 +0100 Received: from [209.85.219.53] (helo=mail-qv1-f53.google.com) by tlsNG-c201ff.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946e8-4cb1-0a2a45050019-d155db35e98c-3 for ; Tue, 03 Nov 2026 03:28:56 +0100 Received: by mail-qv1-f53.google.com with SMTP id 6a1803df08f44-91c67992ce5so27746786d6.3 for ; Mon, 02 Nov 2026 18:28:56 -0800 (PST) Received: from toxicpanda.com ([153.61.196.245]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91ca7b779bdsm105433276d6.0.2026.11.02.18.28.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:28:55 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672935; x=1794277735; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=sPhoPgLC+8GlCU41+5ydGuziU72t8bYzLKeHnMqsGwE=; b=kK5IkJRLTIbsagTFDfiRsVqC45NZYCGAjO7bexZGI9llKknu57E8pIpa8u7tRL0h92 4dFgAcspyAWd96Zir5QUTzzJ8vx4bPEazj0IVSJXsSdebTd02v3eUzt7wFa5wVttfP3Z VIGADzWywlQ6KfiLJK3OKMZxvlZ86GfSZw4Y8sy2jLjl9KPJAmpTa31V/pdzf+BgaETK KhUHhuDX8uRQIqRhn5vGeuXJ4sNSL0Y+wqHNbYLPqtM7Kk9AjybU8sACSqf3QNcp/U0F nKPm6CBG3OIPpPhPRXxAuZ8xJgQByJ9gZvvyHoA4gaHi9iVGKtGzYXtHygAaTuT6iUKv vL0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672935; x=1794277735; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=sPhoPgLC+8GlCU41+5ydGuziU72t8bYzLKeHnMqsGwE=; b=bVIaIEta88G6NRXy45IF9bawA1b/xO3DZfPVG0BxlkCTatAZ1YkmT1Mf4QIKwgq0jA uKlFp3jmPogcNdwHKHhABjOARYib02Ua8PKqZREy4vFEDBeB7Q+VRUzCL7anSol1dJrs k8z6WUHnfgyGl9+LID21eAiTGRpdO5qytL69PCN/yq9qM/AvpwPJBxgXDxHjvoAT7hNg olU8Ho+f4Qi6jPzQ2OHLN+2L9Dcfn002LVW2YHK/6CIwNI8At27hqWDo87cPBs0dXV0U U6cWbwu9zszimJxiDUG8abN29Dq0YFtRhIs1CasDtJC1YaiZo8iNRwT4b+q7a82p4YJP /CQw== X-Forwarded-Encrypted: i=1; AKwUvBzPJ7T+EsgflnaeQqcBj+7Zh7Z7uUV27Fy0Y1MwuCuQv+MRt/XDOP+X3T8dCsp8aRVk+qVbNNM4T24=@lists.xenproject.org X-Gm-Message-State: APuU4Z+sBe4BZWBL40VJM/jGCS8p0cN3ZHcsL7hKurO9fjJqRvEm7EnR +3DleRy35zMSmyrnA7IuUfVUqQyDqltu1gs9aA5rWjGATpCA+bz2Njs8AuFivSiyIA8= X-Gm-Gg: AYBFou1JuyTvffHR2jA1uBuwqT4xG3mx9CoVgfK0tbkP+uKqw+nAxEXCwXeGQUIli9S W5Zut76/oev/KgPWQ5gltfdIcAJHvh9AoWfXERjerKOj0AsZ+HC/Sh8FoQbo8SrAa2o6Qx32/a0 5jEMWhjrI46ef4Pg/SBJk1uPN5ECFi6lANWb3+fykZEnp0POblHI0Z2KkIGGJ4KC8IKFHZIIVAb eEm0b+7vDq4iPD9IXiUlP74A2NVLe/+SRH7LgtR1DIk5snKYds0+hflzYOIdq7+5WVp7ypPlcRO Nlj5xFeSX4gFQUVFgAHCuUoCku61XCnaQpAhTSqXBUM2GlLkpVcY9D8jeLype0bG1OHxuf9EdTN 1bp9LE3O8TG1ClkJ4yOBxyk42d55b26VMSj4lvi/gkDkeDWXn3mX+nubd8N3pqO5iCPRLj3sFCZ O/Pl4UTC0Gs5M5tY3RUDwpHkf5TztFWyThmWmdW4ASSuh+LJCjqpIFtlBe9NUu5tk0YbLTjvh+U AutdiKi9hphlR73tAd6X+UQE5AP/Yqb2VNx2GqNYmf6QJwerBB8jYWIJUHjv+J8aVVh9M/YyEFy 5rACqi0C5srJ1tmjuPQ/YUjxVM/j581QJJod7Rr4hjQpOg== X-Received: by 2002:ad4:4ead:0:b0:912:517b:7bdf with SMTP id 6a1803df08f44-91ca4b92850mr197093996d6.42.1793672935525; Mon, 02 Nov 2026 18:28:55 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:31 +0000 Subject: [PATCH net-next v3 05/15] net: skbuff: drop hw csum if trim can't checksum tail MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-5-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672922; l=2083; i=josef@toxicpanda.com; h=from:subject:message-id; bh=WIgfTZtqwaWkzQDUXyCO+jFusNbjYdApARwauRRfo24=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QKW99vHsClamyUP4X27NpnKqyTYOkfRWB4KW7NXTD/O0D66lYe+SBZBVME9SfN/NW1ccijRiLzr 0OXJ6VI31mQw= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-c201ff/1793672936-728B62A1-2A03643C/0/0 X-purgate-type: clean X-purgate-size: 2085 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672955657158500 For a CHECKSUM_COMPLETE skb, pskb_trim_rcsum() subtracts the checksum of the trimmed bytes from skb->csum. It gets that checksum from skb_checksum(), which returns 0 if the trimmed range runs into an unreadable frag_list member or past the end of the skb. skb->csum then still covers the trimmed bytes. commit 2e357f002c61 ("net: Avoid checksumming unreadable skb tail on trim") handles an skb that is itself unreadable, but not a readable head with an unreadable frag_list member. Use skb_checksum_full(). When it fails, do what pskb_trim_rcsum() already does for an unreadable skb. Set CHECKSUM_NONE if the remaining packet can be read, so that software checksums it, and fail the trim with -EFAULT if it can't. The stale skb->csum was only reproduced with a hand-built skb in a test module. Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Fixes: 20ddd0fd2fcd ("net: skbuff: don't BUG() on leftover length in skb_ch= ecksum() and friends") Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 5f997edf3519..68801a4f471b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2821,9 +2821,23 @@ static int pskb_trim_rcsum_complete(struct sk_buff *= skb, unsigned int len) int delta =3D skb->len - len; =20 if (skb_frags_readable(skb)) { - skb->csum =3D csum_block_sub(skb->csum, - skb_checksum(skb, len, delta, 0), - len); + __wsum csum =3D 0; + int err; + + if (!skb_checksum_full(skb, len, delta, &csum)) { + skb->csum =3D csum_block_sub(skb->csum, csum, len); + return 0; + } + + /* The trimmed bytes can't be checksummed, so skb->csum can't + * be adjusted. Software can checksum the remaining packet + * after trimming, as long as it can read it. + */ + csum =3D 0; + err =3D skb_checksum_full(skb, 0, len, &csum); + if (err) + return err; + skb->ip_summed =3D CHECKSUM_NONE; return 0; } =20 --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672958; cv=none; d=zohomail.com; s=zohoarc; b=DnPcI4dEQeb/LLYkJK5lrYLtCqNjahcu4RsIiJOesAOyeMnpagE4kruuyQ9edqwBz+PZxs71RA7YgC7EOaThDOyY8Eg7IRo4YtRNGGmUkjcYo1dtLO7+d8c8SH44zSzqQjpwFOEtvGlZR/F2sYFGLAxHELiETLCGE3Y7/1lOssU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672958; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=lzfHr7VS3R55wgwqyUPsK6dja/9+8+R/PoE9WBcM+FY=; b=bvM2rHdEnL1fnYXlgnQArLXqEEGpI/J86HZpAXerzCO/kYtn+N8hm1WWqCZqYLLvjhyTUyLIxoQ2g6QQXFttWRMmAfXDdxBag2h1g4ETeNsh+DKixZRWsygAfz2ZPkyG7ts3tRxNgVXKKQkcbNNI7ilX1Gw0hOVKVj5JzkRYpFc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672958421500.294577011347; Mon, 2 Nov 2026 18:29:18 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468936.1677970 (Exim 4.92) (envelope-from ) id 1xO4Gj-00087i-Fb; Tue, 03 Nov 2026 02:29:01 +0000 Received: by outflank-mailman (output) from mailman id 1468936.1677970; Tue, 03 Nov 2026 02:29:01 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gj-00087X-C2; Tue, 03 Nov 2026 02:29:01 +0000 Received: by outflank-mailman (input) for mailman id 1468936; Tue, 03 Nov 2026 02:28:59 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gh-0007sy-If for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:28:59 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gg-00143l-Vu for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:28:58 +0100 Received: from [10.42.69.4] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae9469c-2eae-0a2a0a5409dd-0a2a4504d6de-38 for ; Tue, 03 Nov 2026 03:28:58 +0100 Received: from [209.85.222.178] (helo=mail-qk1-f178.google.com) by tlsNG-ebf023.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946ea-b57f-0a2a45040019-d155deb2d447-3 for ; Tue, 03 Nov 2026 03:28:58 +0100 Received: by mail-qk1-f178.google.com with SMTP id af79cd13be357-93cc1ab5f6cso443009785a.0 for ; Mon, 02 Nov 2026 18:28:58 -0800 (PST) Received: from toxicpanda.com ([153.61.196.245]) by smtp.gmail.com with ESMTPSA id af79cd13be357-945c1757d8fsm183190485a.2.2026.11.02.18.28.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:28:56 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672937; x=1794277737; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lzfHr7VS3R55wgwqyUPsK6dja/9+8+R/PoE9WBcM+FY=; b=OpGGdEmw6WPOUHEl9RARlbY9EtpI6WFlI/7hrneD32wIY7Xdx5Rm1XQnrm/i40YypD JI7kKzN60hWD9M9xbZPSD/8c8Euec75JGqNOzEZhRJHjhsIdNn2J50hnwW4HY9P/Wnh3 IvjZqur1qKf69I1HEllblijarL2upcomR98aHkisjn/SJMrCX1MrQnoBJeApOFjuGscF 9rrCRWcDEp2KwaiY2sgVV0t68QT/d2zH6Wa8fQpag4B6weROMUoqIri1wMiYnBZzPU/M qpyL5JEuqibnHW7eUTH3tOrLWytxEy3rtj7Jpg3gN8W8RbHVk0MzADxKHig2Emm6qlJV 4pfA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672937; x=1794277737; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=lzfHr7VS3R55wgwqyUPsK6dja/9+8+R/PoE9WBcM+FY=; b=fphy/EGmGr05t7xK7c33HO7bUQIUNYu87yVgF753dN7gfZLMcoh2jImUapXoyqDhRS rVLBLmR66TvaKIztOrzQVduxOqy226JbltiBY4MQjeY39n9f8l2UIHmHCASSCJJs7x12 fn2jYpjxM6FyCbd/kapFpjC4v8yyrqF+lSVpkC/Y1cPZpHfjjfmvqDnw/awvxVjiLact 67/AhfVRuBF4F6zy9iiOe/i142Z3aLWElHYeauO7T1G34ClAEd26A+Fw3Clj2K3or3KB jBORY06PEkXQWAZ60sDTZkDbwC5lM4yrGEHpbYqIGPwrukIM30OhHddxQ2HacGD6oRXa ECvQ== X-Forwarded-Encrypted: i=1; AKwUvBxc9MV9AhQWCTJm3D2oNcDTiHYRtUJfgWbda2ugKnJn4hsDsqxGDpFW5Bt0SNbLICEMTRQkZTgB8IQ=@lists.xenproject.org X-Gm-Message-State: AFq9FYJ9vTuQmUckhkoKvkZsKHyRniIFdrQ1O+w0SKnKIN1xvKkWKsoH ib61QtlENJ9k1oWhN/dxo31JAGX4HL7J6vyUJGgT32toQiz0OwebEGXxd2LYLlRb5fQ= X-Gm-Gg: AYBFou1x35RTGMUshIVP9MyesTIoliw0A5rd0WU+nMBYOVtXpmP4pDOn3itW7yAADEC TaPnQLW3ZHxkNZWk0ajrZDbIgsN5NJ7YfofwGJe+Edik6ViwDiuxAIgssuapCcIOusY6exaAZOD 0kRai8Tit+oENYqgAUSlS1CdOOaAgX8azrFfl6UY2/yCrAUBrANnVAgDtSKzDOyZQ+N61JASGl3 Qk434AaFYphhUIH4MzTWTLrppfbgj9eoVV82ynUz4jHBCqyqmXDxoAUkLmyqjBff2y0TXd6IUv/ eXAAg8ub9eYiXcMaXUEb9bbqg3GJgUMXH1aDQSGsYq+9HsrGLJmy7+AZuLFb2/iCELqVOdwO7xq IGOM/pqzQ8+5x7MdgX/SbTYZnAayzLFo17VrNPB4A3Tck3yul2Yea6211cpwjEDoo6hKbgVqGWQ 7qvsVopvrIaaCj7Ftnu/MIYZwDpRmyimUIZPGYGBPBr8ZzNGCxFVEicLCZ01QB7NWFDfB/dU1OL sz/vCBcJLpAzbActjsMyK2MEf3cF+AR1EbTI1TT1ThKIrukVCNuz3bZazdYGWaiPbwAOHOQPjLs MEW3IEjOgCur5H5BZuYkQk/0zVWYVZG0jj30KsWXbyjlG6M= X-Received: by 2002:a05:620a:4515:b0:93e:5cf8:e5aa with SMTP id af79cd13be357-944216f1f16mr2068343185a.61.1793672937350; Mon, 02 Nov 2026 18:28:57 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:32 +0000 Subject: [PATCH net-next v3 06/15] net: skbuff: add skb_crc32c_full() that reports failure MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-6-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672922; l=5927; i=josef@toxicpanda.com; h=from:subject:message-id; bh=xQ13tNp8b5b8bmXMu0MecWu7GssBiAZfq3djIXb3o+I=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QMNAudkydV4sX8J5UoevpFC9R5qZwEOJDugWoZB2YvCOLWe1pQlj56Bu8v3uVapFQnfAVmE8Bqf 3/smPffQ63AQ= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-ebf023/1793672938-C1AD0B50-0001E22A/0/0 X-purgate-type: clean X-purgate-size: 5929 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672959799158500 skb_crc32c() has the same problem as skb_checksum(). When the range runs into unreadable frags or past the end of the skb, skb_crc32c() returns 0, which is also a valid CRC. sctp_compute_cksum() and skb_crc32c_csum_help() complement it, so a failed walk looks like a checksum of 0xffffffff whatever the packet contains. Add skb_crc32c_full(), which works like skb_checksum_full(). skb_crc32c() becomes a wrapper for the callers that aren't converted yet. The wrapper still returns 0 on failure, but it no longer warns when only a frag_list member has unreadable frags. Convert skb_crc32c_csum_help(), which can already return an error, so that an SCTP packet that can't be checksummed is dropped on transmit. The other callers will follow with the skb_checksum() callers. Fixes: 20ddd0fd2fcd ("net: skbuff: don't BUG() on leftover length in skb_ch= ecksum() and friends") Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- include/linux/skbuff.h | 2 + net/core/dev.c | 7 +++- net/core/skbuff.c | 100 +++++++++++++++++++++++++++++++++++++--------= ---- 3 files changed, 83 insertions(+), 26 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 5a5354a6b6ba..5581ed3cbf47 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4332,6 +4332,8 @@ static inline int memcpy_to_msg(struct msghdr *msg, v= oid *data, int len) =20 __wsum skb_checksum(const struct sk_buff *skb, int offset, int len, __wsum csum); +int __must_check skb_crc32c_full(const struct sk_buff *skb, int offset, + int len, u32 *crcp); u32 skb_crc32c(const struct sk_buff *skb, int offset, int len, u32 crc); =20 static inline void * __must_check diff --git a/net/core/dev.c b/net/core/dev.c index 00a62c391056..f9878db781df 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3752,8 +3752,11 @@ int skb_crc32c_csum_help(struct sk_buff *skb) if (ret) goto out; =20 - crc =3D ~skb_crc32c(skb, start, skb->len - start, ~0); - *(__le32 *)(skb->data + offset) =3D cpu_to_le32(crc); + crc =3D ~0; + ret =3D skb_crc32c_full(skb, start, skb->len - start, &crc); + if (ret) + goto out; + *(__le32 *)(skb->data + offset) =3D cpu_to_le32(~crc); skb_reset_csum_not_inet(skb); out: return ret; diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 68801a4f471b..15d1f4142f29 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3825,23 +3825,79 @@ int skb_copy_and_csum_bits(const struct sk_buff *sk= b, int offset, EXPORT_SYMBOL(skb_copy_and_csum_bits); =20 #ifdef CONFIG_NET_CRC32C -u32 skb_crc32c(const struct sk_buff *skb, int offset, int len, u32 crc) +/* The frag_list part of skb_crc32c_full(). It's out of line so that taki= ng + * the address of crc doesn't cost every caller a stack protector. + */ +static noinline int skb_crc32c_frag_list(const struct sk_buff *skb, int st= art, + int offset, int len, u32 crc, + u32 *crcp) +{ + struct sk_buff *frag_iter; + int copy, err; + + skb_walk_frags(skb, frag_iter) { + int end; + + WARN_ON(start > offset + len); + + end =3D start + frag_iter->len; + copy =3D end - offset; + if (copy > 0) { + copy =3D min(copy, len); + err =3D skb_crc32c_full(frag_iter, offset - start, copy, + &crc); + if (err) + return err; + len -=3D copy; + if (len =3D=3D 0) + goto out; + offset +=3D copy; + } + start =3D end; + } + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EFAULT; + } +out: + *crcp =3D crc; + return 0; +} + +/** + * skb_crc32c_full - CRC32C a range of an skb + * @skb: buffer to read + * @offset: offset in @skb to start at + * @len: number of bytes to include + * @crcp: the CRC to continue from; on success, updated with the range + * + * Return: 0 on success, -EINVAL if @len is negative, or -EFAULT if @skb + * runs out before @len does, or if the range goes past the linear area + * of an skb, @skb or one on its frag_list, that has unreadable frags. + * On failure *@crcp is not changed. + */ +int skb_crc32c_full(const struct sk_buff *skb, int offset, int len, u32 *c= rcp) { int start =3D skb_headlen(skb); int i, copy =3D start - offset; - struct sk_buff *frag_iter; + u32 crc =3D *crcp; + + if (unlikely(len < 0)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } =20 if (copy > 0) { copy =3D min(copy, len); crc =3D crc32c(crc, skb->data + offset, copy); len -=3D copy; if (len =3D=3D 0) - return crc; + goto out; offset +=3D copy; } =20 - if (WARN_ON_ONCE(!skb_frags_readable(skb))) - return 0; + if (!skb_frags_readable(skb)) + return -EFAULT; =20 for (i =3D 0; i < skb_shinfo(skb)->nr_frags; i++) { int end; @@ -3866,34 +3922,30 @@ u32 skb_crc32c(const struct sk_buff *skb, int offse= t, int len, u32 crc) } len -=3D copy; if (len =3D=3D 0) - return crc; + goto out; offset +=3D copy; } start =3D end; } =20 - skb_walk_frags(skb, frag_iter) { - int end; + return skb_crc32c_frag_list(skb, start, offset, len, crc, crcp); +out: + *crcp =3D crc; + return 0; +} +EXPORT_SYMBOL(skb_crc32c_full); =20 - WARN_ON(start > offset + len); +/* skb_crc32c() has no way to report failure, so it returns 0, which is a + * valid CRC. Use skb_crc32c_full() in new code. + */ +u32 skb_crc32c(const struct sk_buff *skb, int offset, int len, u32 crc) +{ + int err =3D skb_crc32c_full(skb, offset, len, &crc); =20 - end =3D start + frag_iter->len; - copy =3D end - offset; - if (copy > 0) { - copy =3D min(copy, len); - crc =3D skb_crc32c(frag_iter, offset - start, copy, crc); - len -=3D copy; - if (len =3D=3D 0) - return crc; - offset +=3D copy; - } - start =3D end; - } - if (unlikely(len)) { - DEBUG_NET_WARN_ON_ONCE(1); + if (unlikely(err)) { + WARN_ON_ONCE(err =3D=3D -EFAULT && !skb_frags_readable(skb)); return 0; } - return crc; } EXPORT_SYMBOL(skb_crc32c); --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672964; cv=none; d=zohomail.com; s=zohoarc; b=UeGYtrgkW68zNBYFt4bzHOsqXRtitoXJbzn/zlOZNug7j3lp0We1wGNkduG6GPOaDwsnIXEyfhcmC2nOpIe4fbv9ezmrcdpnAVhXpwzh7FPBEcYiOQ0XZ/gDAZRK4evGWw2pQI1VX+9JvI9YnfCyxReiwLqCNjOGfaqTpCR8+/0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672964; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=DcFo5FOvZmv6l4451K3/sYsoJxTuD/ptYd3JpfIB/vc=; b=YkCAb2b8VAVNKRwx+qpWcYMJKgeKnM8Z66O1uI7fTFt4PGKzIzkA00rz9w65hs7RZyJvK+6KDKC9Fxi+p0G7TZ6aiWjrEXo91jpAMUTG5IWwcMZAu6jddB9UVBMyt6fC6WK2Ju0BaDBDNmPE1TzNmlfrZK5cbCh2WkhPTnZucIw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672964631190.81992946857918; Mon, 2 Nov 2026 18:29:24 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468939.1677979 (Exim 4.92) (envelope-from ) id 1xO4Gl-0008OJ-1K; Tue, 03 Nov 2026 02:29:03 +0000 Received: by outflank-mailman (output) from mailman id 1468939.1677979; Tue, 03 Nov 2026 02:29:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gk-0008O6-UF; Tue, 03 Nov 2026 02:29:02 +0000 Received: by outflank-mailman (input) for mailman id 1468939; Tue, 03 Nov 2026 02:29:02 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gj-0008A8-QB for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:29:01 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gj-00CYCC-6W for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:29:01 +0100 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae94690-e002-0a2a0a5209dd-0a2a450cec40-20 for ; Tue, 03 Nov 2026 03:29:01 +0100 Received: from [209.85.160.175] (helo=mail-qt1-f175.google.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946eb-f479-0a2a450c0019-d155a0afc83b-3 for ; Tue, 03 Nov 2026 03:29:00 +0100 Received: by mail-qt1-f175.google.com with SMTP id d75a77b69052e-5364042eecfso60665371cf.2 for ; Mon, 02 Nov 2026 18:29:00 -0800 (PST) Received: from toxicpanda.com ([153.61.196.245]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5498cf4c174sm13684401cf.29.2026.11.02.18.28.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:28:58 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672939; x=1794277739; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DcFo5FOvZmv6l4451K3/sYsoJxTuD/ptYd3JpfIB/vc=; b=OHeZKGKd0JsuKgsZKymYuxj4KPusK+K21lsvG7x3VyiBJM0JdnZ5OCTqnw1N//iERx CCBmlnk/VLQohQ81ai/6sLfb5HGT2RJpVRjNnnTsttaaT9Uwt0cX6paKO2pAnJbeb89Y Tyxt2BpomiGUPaKTGPrBmzk+mtac9jHwEyyCTZiqWerZs/I5yhBhSNvFDfzX6Avuspi3 MnQcts3HYOvmWLXVBWToo6T0K2Xylm7QECqbto8SB6mXLTkCkSZKc9Pqwz0vz2ONQPLZ LJyUaVY3Vif/dwaj6qjJq0HFhLLkLFpxPZDWVA6DjQynzddX4CmhX8MdRKpri2+8oKDs XW4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672939; x=1794277739; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=DcFo5FOvZmv6l4451K3/sYsoJxTuD/ptYd3JpfIB/vc=; b=N4M+4fsxEoklkAuJMpmd1qWTTEG2t64cdoB9OTCPdFagRG+yjBwRm0C+aPt24rlyqE /1NjS8ldDBm1RzABwRJcthQSG4h8zCmzBQkX/G1gF4BVpC70VGkgkOs3iPZmSYtmRWnd 2SzAF1UuHjXYhPh6h842Mdbd834n46oxYcvhKEXjFLx7qAOa64Avtjhmq7sByk0tCflo om6cY8kTHGM+BmSFrEyJB2oxjBWV3uTOzuEh5ZYfwrExpnpUsLOlAqLoZ0YNCo0sME+8 XkRq6lDEngsp7OgtIKFJ7KyIbJe3bU1CuUxVCnTzJ5EKdXdj+NnACHVpaEQqnVIRbtZw wTqg== X-Forwarded-Encrypted: i=1; AKwUvByTQj3JE8dvx3vVWNeoCbXHWK1pRy1Bo2rqEyoeuITlUlBy7ZAt4MRRjYnTL0+yJopcZgG3PhTzU4A=@lists.xenproject.org X-Gm-Message-State: APuU4Z/rzZhmDxKLUKHpzBNPywOdp/SiqPwdZl8RPK9HIuNo3kiFq5AS rPwIOdvQNFs4Mm1xs99snUsj3QixinA+mrNDNVrlge2TBZc9uESiz6Rodad4FxwiEcI= X-Gm-Gg: AYBFou1jdCJ4PiE4CHTd6ccVMdEs5ConEc6WOeNcVrUi1gYvWmZkiCPwEvLWmjB9uCG 0Sea7IQIf8ZffjAiD1CB0juzqw0ywgDVl/oLSFv6/9Ql9pp5jUWYgSJvJXtfr/8Dw8OY9iqNJsU ekHTPpBsSQX+RIIHA5yPbSNM2uebZeA2N1d39hxvCA5fG0OO7oSp82X4x/wInTyZ/gZdKlmecly fvhNsEYJkuUYZRG6SIPP4ILf6ohu/K2gKZpx+uG6Wa70sGtYqoGBDEXSMuZ1zp1S2RJekKkJHcX VwHZ3QG8L/6NOiE8enwCYSw3At5hXGF16WieA5R5dtfz0GX98Pm8bz1mWPHIG9/bRQVbDYZjG4P 0IF47jB0JgEKqmKUcBI/DlLopdyPxvR/eDI/dlhEoL2H1SDo1xzMILk8U+FDRqKzC/B828DU/PQ 0jAH7zOEYlzZa62T15arGZQVxIwt3a/00sFxDoWLg16vzek91Wee1RxCv5JrUA/HhzickndncUN ibWfy+d7tWKrpcDeTY68uBSjn7xD1sMLlVAuqB5urjc2wFSENmlZZUBHc4FvlFXOFHz6xfdCpS+ 8A3daf51BwIQmiVfwt/QE2NtLFd3WX0QDS59QtBDIazSzA== X-Received: by 2002:ac8:5f8c:0:b0:535:15a9:2516 with SMTP id d75a77b69052e-542b75248e1mr201824771cf.53.1793672939316; Mon, 02 Nov 2026 18:28:59 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:33 +0000 Subject: [PATCH net-next v3 07/15] net: skbuff: let skb_zerocopy() copy a short skb without head_frag MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-7-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672922; l=3270; i=josef@toxicpanda.com; h=from:subject:message-id; bh=h0Wqrzd3xqr+PYqL1pPzooJBchVLWNZbZHd25h+Yqck=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QM+Y4diaiiBY8eankmF9aAo6/WhJsaCKYztAziuHXrT++wyED3G5cAIsbBu9yfcjJg9jVGYbpO6 rhMjmGXTK1wY= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d25034/1793672940-776D6A5B-D43AD7CB/0/0 X-purgate-type: clean X-purgate-size: 3272 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672965874158500 skb_zerocopy() refuses an skb with no head_frag when the caller passes hlen =3D=3D 0, because it can't reference such a head as a page. That check sits ahead of the small-payload path, which copies everything with skb_copy_bits() and never references the head. Open vSwitch gets there with an ordinary request. OVS_PACKET_CMD_EXECUTE allocates the packet with a kmalloc'd head, a POP_ETH action on a 14 byte frame leaves it empty, and a USERSPACE action calls skb_zerocopy(user_skb, skb, 0, 0). The upcall fails, with a WARN on CONFIG_DEBUG_NET kernels. Before commit 433380f5ab8f ("net: skbuff: don't BUG() on a missing head_frag in skb_zerocopy()") it hit a BUG(). The request only needs CAP_NET_ADMIN in the user namespace that owns the network namespace. Move the check below the small-payload path and document the -EFAULT case. A genetlink reproducer run as an unprivileged user in its own namespaces warns before this patch and doesn't after it. The small-payload path hands @len to skb_put(), which panics on a negative value, and nothing runs ahead of it now. Reject a negative @len or @hlen on entry with -EINVAL. Neither caller passes one. Found by the Sashiko AI review of the BUG_ON() series. Fixes: 433380f5ab8f ("net: skbuff: don't BUG() on a missing head_frag in sk= b_zerocopy()") Fixes: af2806f8f90a ("net: Export skb_zerocopy() to zerocopy from one skb t= o another") Link: https://lore.kernel.org/all/179173804997.434549.4450793967361922984@k= ernel.org/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 15d1f4142f29..d79d8463c44e 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -4072,8 +4072,10 @@ EXPORT_SYMBOL_GPL(skb_zerocopy_headlen); * Return value: * 0: everything is OK * -ENOMEM: couldn't orphan frags of @from due to lack of memory - * -EFAULT: skb_copy_bits() found some problem with skb geometry, or reada= ble head - * payload would be mixed with unreadable frags. + * -EFAULT: skb_copy_bits() found some problem with skb geometry, @from has + * no head_frag and @hlen is 0 while @len doesn't fit in @to's tailroom, + * or readable head payload would be mixed with unreadable frags. + * -EINVAL: @len or @hlen is negative */ int skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) @@ -4084,15 +4086,23 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *fr= om, int len, int hlen) struct page *page; unsigned int offset; =20 - if (unlikely(!from->head_frag && !hlen)) { + if (unlikely(len < 0 || hlen < 0)) { DEBUG_NET_WARN_ON_ONCE(1); - return -EFAULT; + return -EINVAL; } =20 /* dont bother with small payloads */ if (len <=3D skb_tailroom(to)) return skb_copy_bits(from, 0, skb_put(to, len), len); =20 + /* Without a head_frag the head can't be referenced as a page, so the + * caller has to ask for it to be copied. + */ + if (unlikely(!from->head_frag && !hlen)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EFAULT; + } + to->pp_recycle =3D from->pp_recycle; if (hlen) { ret =3D skb_copy_bits(from, 0, skb_put(to, hlen), hlen); --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672958; cv=none; d=zohomail.com; s=zohoarc; b=ZAYvkQQAJkmpkXBqsK9k0bj5cfrYDpMnt8gaciXVrlY0uiiEKx8CPivbSywT3u9BGglRkD97/iMXzAJ5FYpTJKbzU5VjY2/YsQklqs2Jp52aJXrTd1cXlsvrAvXjwkZAvBZd6+ln/wCELtP9pOEAeByTU4Sfh/5qIrb5mWZ9ev4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672958; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=bijbOirZ4Girus6JZtdOIUGExRiLbvnwYnc1tpajYRo=; b=YwHYudYCHyBAfUaAHk76mkBVDFd3P/jX8Dpjf5K62sa3SfsNn5+CeAsEN5aPDjaHamQ0ot/0wJbWHkrk9LwnpU9XJfqESflH0tiKTUznZgCDrBfLu7zU3DIFr0HvagyjXbeh3Fol4bTjHVYM0v5QgH6VNEkSrAGI1ygVZRSkYRo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672958523608.3981866780475; Mon, 2 Nov 2026 18:29:18 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468941.1677988 (Exim 4.92) (envelope-from ) id 1xO4Gm-0000CF-BC; Tue, 03 Nov 2026 02:29:04 +0000 Received: by outflank-mailman (output) from mailman id 1468941.1677988; Tue, 03 Nov 2026 02:29:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gm-0000Ax-5o; Tue, 03 Nov 2026 02:29:04 +0000 Received: by outflank-mailman (input) for mailman id 1468941; Tue, 03 Nov 2026 02:29:03 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gl-0008O5-3r for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:29:03 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gk-006j9s-HA for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:29:02 +0100 Received: from [10.42.69.11] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae946e3-8faa-0a2a0a5109dd-0a2a450bb658-2 for ; Tue, 03 Nov 2026 03:29:02 +0100 Received: from [209.85.219.54] (helo=mail-qv1-f54.google.com) by tlsNG-42698a.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946ed-b7e8-0a2a450b0019-d155db36a57d-3 for ; Tue, 03 Nov 2026 03:29:02 +0100 Received: by mail-qv1-f54.google.com with SMTP id 6a1803df08f44-91b9e758c50so3096676d6.1 for ; Mon, 02 Nov 2026 18:29:02 -0800 (PST) Received: from toxicpanda.com ([153.61.196.254]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91cb4478981sm75612356d6.35.2026.11.02.18.29.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:29:00 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672941; x=1794277741; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=bijbOirZ4Girus6JZtdOIUGExRiLbvnwYnc1tpajYRo=; b=ZURCodQMdHCoo1vJxPygv3+zeng+Nb1PfSYWXtL3KTzB42SnFzin1GAXcVWKCvMUdz cAsSdk4aJe2i3Ubseu19Be9EfTuLlMus34pzuBhZLeLRdkTK3fXKbHxe/93NeCVMVYtO HJrXki9Y0IC2ZVf5WZR3/OZX1lrRphLZTsjm4ki41edvv5lWt9XT2OwBBgyYedn2PBrz zuL5ztz3U0vIiduNU81XobD/IQiX3uq7mgIjtRc5VOpJfeAz0VdQ9apvRwdpPbZTL+rc 4VI26aK3TcO6nCDJ9/uVHS7rxNifyUl2GxC30b3t+xYwSAiAWqymZJaUzy62mIQ26+TS JRbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672941; x=1794277741; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=bijbOirZ4Girus6JZtdOIUGExRiLbvnwYnc1tpajYRo=; b=E5I6ee+M9ivbA0aMjLHQR+LIaJ29PZmKBfR/OyDti2NVA6Zdw6j4R2l1e3mt8JYts8 q4ZWFGqyZPJd4e+EbnWWa5LeCdHD9H65aRmSDMH1LJ5ahc7vS+HMHKVKm4207pGUfCyY +M9O4ZykXWngH9ErlV1OlMrFrrhH3L/czqOfBaP+u5n+OQOaXXaHmtwuGDsX9QI0HQCX 03GmUCLGMsaNlDCgrwZIjf1W9dIbXYuHl5Zo/kclRKWYe5Fm5+YYhE6uZ746XgaLIYbo sdyTLUShwqjMIlVBFoQZzAtM0VqJUI8Pmjq7HMaoWkNG2Mnftog4BcdQLfE5Y1jlElaX 4dzw== X-Forwarded-Encrypted: i=1; AKwUvBxq+1QZdlCn1J4NzsxqnfVF9b9aaZt6jlszT5oSpJL789dmsZpHNr7kZCSPSYWYaaVMJfrNQEW7CE0=@lists.xenproject.org X-Gm-Message-State: APuU4Z87no2b1Sm4gbdkvHrBGz3RA3HQIbzSFiuhtojOAhHrN5al2oOE 9VPO0yqt5gU+7UWA+Hl6dlKwHWse/aednLYOQpns7a2jMLiZDWPsXkcat71+3LkK9w8= X-Gm-Gg: AYBFou0EVRKWGE78zEx5QBEONyhVZ7m4WGZtvPIp7ZddGTkXLhYS51cJvg48RTpLnW8 x6d2/PGyH+rrTUZR+i3yruAKEsF79/UtgBUorWwSf13Z0Uhvw8+dmZJdyxOL+C+ksiMLztstutK M3SxHl/no2AasdOfWq8YhJN02m4pXRcw9gcLbYHfw78Bmos5lZt2cLMgFS73WNDGgbtsznVLhez 3IA19V/AahE9zHE0yJTjrvJ2r+QITfe1OO+B1Iy7BnpzYMSIhsCTy29/EP/VW266JO1xDn/QDNe IpVYcWT6krE8Dr6FDtS9rmu6V1MUs7t5XNcdsiVYE4yeXELhv7bhWXd3J7IzATF7Z/aDMrVoE/U Crn50f6Osd9DaTAkZu0jvhWaIt0YZiehnkmNf7yclbcXAR9gavOx+iWPBuDgGJ7UqzOosZ/CX0p /Riwp3wj7kSsfxhstLGOvxTC/hAxI9NsWxYtJMuyhZcKQrGn3nR7h4ZQQLp/w7haqISCUo0WIPo EFll5nxin6CWeb2lNuW3+wm83ytTHjDnfTGy5YpmV9t6I4ZVNSaHAlJIDI+NA+sZOqmBc7PDG6R gGUqrvb7ecT8bqR6ecZ3ukFW9u8PLxcNrTt7lbZHu7cJ0w== X-Received: by 2002:ad4:596c:0:b0:91b:b26a:9793 with SMTP id 6a1803df08f44-91c9089912dmr253427966d6.35.1793672941013; Mon, 02 Nov 2026 18:29:01 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:34 +0000 Subject: [PATCH net-next v3 08/15] net: skbuff: make skb_try_coalesce()'s len unsigned MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-8-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672922; l=3910; i=josef@toxicpanda.com; h=from:subject:message-id; bh=1Y0cvQvaM5FSv1SKjKnlMhZ0E3xrC/xLgZhh+okRfpo=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QBH7ZWBZQqHx6yS5pMlRH07gVqL72akx3JP37eJaittte4ldQJH4Xai9J9l8tM0eu/jylaeSWnS SeZVX/4+BAQo= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-42698a/1793672942-2C39B9EA-AAFA9BBE/0/0 X-purgate-type: clean X-purgate-size: 3912 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672959780158500 skb_try_coalesce() keeps from->len, which is unsigned, in an int. A corrupt from->len above INT_MAX turns negative, gets past the len <=3D skb_tailroom(to) check, and reaches skb_copy_bits() as a negative length. skb_copy_bits() returns -EFAULT for most such skbs. If skb_headlen(from) is still a small positive value, skb_copy_bits() clamps the head copy to the negative length and memcpy() takes that as 2GB or more. skb_put() used to run before the copy, and its overflow check caught most of these lengths, but not the ones that wrap skb->tail back below skb->end. commit 279877d86c82 ("net: skbuff: don't BUG() when skb_copy_bits() fails in copy helpers") moved the copy ahead of skb_put(), which left only the tailroom check. Make len unsigned, like from->len, so that such an skb doesn't take the copy path. It gets to the truesize sanity check instead, which sees that from->len is more than from->truesize can hold. That check only warns, and only after the head of @from has been added to @to as a frag of that size. Make the check refuse the coalesce, and move it ahead of the head steal so that @to isn't touched. The check compares the int delta against len, so it now tests delta < 0 explicitly. An skb from a driver that under-reports truesize used to warn once and get coalesced. It isn't coalesced any more. A test module that coalesces an skb with a page frag head and a len of 0x80000010 gets false and an untouched @to. Found by the Sashiko AI review of the BUG_ON() series. Fixes: 279877d86c82 ("net: skbuff: don't BUG() when skb_copy_bits() fails i= n copy helpers") Fixes: bad43ca8325f ("net: introduce skb_try_coalesce()") Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f73289= 5b@toxicpanda.com/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index d79d8463c44e..e400990595f8 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -6478,7 +6478,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_b= uff *from, bool *fragstolen, int *delta_truesize) { struct skb_shared_info *to_shinfo, *from_shinfo; - int i, delta, len =3D from->len; + unsigned int len =3D from->len; + int i, delta; =20 *fragstolen =3D false; =20 @@ -6523,9 +6524,6 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_b= uff *from, return false; =20 if (skb_headlen(from) !=3D 0) { - struct page *page; - unsigned int offset; - if (to_shinfo->nr_frags + from_shinfo->nr_frags >=3D MAX_SKB_FRAGS) return false; @@ -6534,13 +6532,6 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_= buff *from, return false; =20 delta =3D from->truesize - SKB_DATA_ALIGN(sizeof(struct sk_buff)); - - page =3D virt_to_head_page(from->head); - offset =3D from->data - (unsigned char *)page_address(page); - - skb_fill_page_desc(to, to_shinfo->nr_frags, - page, offset, skb_headlen(from)); - *fragstolen =3D true; } else { if (to_shinfo->nr_frags + from_shinfo->nr_frags > MAX_SKB_FRAGS) @@ -6549,7 +6540,19 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_= buff *from, delta =3D from->truesize - SKB_TRUESIZE(skb_end_offset(from)); } =20 - WARN_ON_ONCE(delta < len); + /* @from claims more data than it has memory for. Leave @to alone. */ + if (WARN_ON_ONCE(delta < 0 || delta < len)) + return false; + + if (skb_headlen(from) !=3D 0) { + struct page *page =3D virt_to_head_page(from->head); + unsigned int offset; + + offset =3D from->data - (unsigned char *)page_address(page); + skb_fill_page_desc(to, to_shinfo->nr_frags, + page, offset, skb_headlen(from)); + *fragstolen =3D true; + } =20 memcpy(to_shinfo->frags + to_shinfo->nr_frags, from_shinfo->frags, --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672974; cv=none; d=zohomail.com; s=zohoarc; b=ces01Qpu8dKec0pRngjYcJS+I3cV+g7/EECqylcp+xYdCgutUnTTmGuWTiNa6D+kUEVmLpK8kVmBhH7PiQWEEGgmjPAJVeCU1W6VmFnxZNRgV0SdjLw9a7eVxOAO+MCvJWfkG6IFBVmQRokvctfr9kEvPtnYqbymP021e9TExv4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672974; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=YMQaM+kfeGbudokxSYshH02k0TvoZ+jUfxqiHHa4FNU=; b=diE0BtJvLaNTx+xOqQamekaXwJPUXUvoDZKghwpfTZVuf0bZ6F9UGz5gAB7UeZ8yIYBAvMpEONzYC89UlrynFfXaHf2ekHq655ea9TKldkOJnlnPKRhJW9faLlW8TWZ4KZA4RbSzkJSmuRPFTGsjSa31P65XXT27TVoVa15L7vU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672974153220.54362801061006; Mon, 2 Nov 2026 18:29:34 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468943.1677997 (Exim 4.92) (envelope-from ) id 1xO4Go-0000WA-MA; Tue, 03 Nov 2026 02:29:06 +0000 Received: by outflank-mailman (output) from mailman id 1468943.1677997; Tue, 03 Nov 2026 02:29:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Go-0000Vy-Gb; Tue, 03 Nov 2026 02:29:06 +0000 Received: by outflank-mailman (input) for mailman id 1468943; Tue, 03 Nov 2026 02:29:04 +0000 Received: from mx.expurgate.net ([194.145.224.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gm-0000Ip-Sc for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:29:04 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gm-009OZN-9J for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:29:04 +0100 Received: from [10.42.69.6] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae946a8-bab6-0a2a0a5309dd-0a2a4506a9a4-20 for ; Tue, 03 Nov 2026 03:29:04 +0100 Received: from [209.85.160.181] (helo=mail-qt1-f181.google.com) by tlsNG-16d1c6.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946ef-195a-0a2a45060019-d155a0b5e9b2-3 for ; Tue, 03 Nov 2026 03:29:04 +0100 Received: by mail-qt1-f181.google.com with SMTP id d75a77b69052e-537548b811aso30168381cf.3 for ; Mon, 02 Nov 2026 18:29:03 -0800 (PST) Received: from toxicpanda.com ([153.61.196.253]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-549893ec3e3sm14050831cf.3.2026.11.02.18.29.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:29:02 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672943; x=1794277743; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=YMQaM+kfeGbudokxSYshH02k0TvoZ+jUfxqiHHa4FNU=; b=OwCpMaId3UzkGFGKA4XhO1paemYGX19iFiQRjzr+HDH3hpcrPnJB9gN/JBlAXXwNqe IvbQaEIvPRogAKn/eqCbt2apNFWuJl/+Xm8E+F6lBg5HgcZtEJi4QPidVwFTFyy9JKt1 vgbh7TX+KSP/A5P6oeV0Qv4D2KOENphCLI2edI9wdGkH2M9biwsCJFq76HrWT3sB294h 72bEAy6mDirXaKdpuj96WaHSWQObBHEkWSLY5dz+eoW7pjjh7CzSYumGK59kyJ+KS+F4 1ub7rRgfyklNe0IQKcXsC4X4OHTue2+yKgq9svnUu6TdltE9l77nXWq+jYz8sJvIh45o WIew== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672943; x=1794277743; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=YMQaM+kfeGbudokxSYshH02k0TvoZ+jUfxqiHHa4FNU=; b=uTbxiYZ/sVC0ldD8i17AOvRWC0KfOdKnkD0l8qET4ButAu3A1eOBg/FCz+PNIbcfkI U4dWezteSl7YrvZBDCXYhn3wLNJLBUrWVZk/OLswX/HiUGZGtS32NtKbc1c9QZ6MYmL4 zvqdPe6NcLEhG93PcQASOjB+t9MJydUhcW5k6+0l9alZ4XD3+JpBZiJTcfa4k/4GMdeh 8CaaegUxry8/4NAFhouGtI4xwYLh/Nrgr3JGx8CFAYousnnZou2NYRpVLy1+Ts6hMLxS 81sIU7OBmvNpZ1Zs05NPVNz3CiORmWGdm9Bd4REmw9nqshRqVncrZKIP0NBN+DhCSy9e lSyQ== X-Forwarded-Encrypted: i=1; AKwUvBxZE2xZRuzotGLNKyMO4kCXiNRKKGR4foW2j4pO+9SOyLqotkxtLmsDIIMxTUrsceEsjKz17drbS/4=@lists.xenproject.org X-Gm-Message-State: APuU4Z+69ad975gbst9G7PO3c820hfRJdPFLMXCSH4WoL3AvP/vmtSmW ylx/mTXb4Jmq1UgK3+drdaE8o8H/VXLv0gFQSkNJQCfpIkUTGJ/3s1hU/xw8nJg82Pw= X-Gm-Gg: AYBFou02v26BJmzrdpJ1XSBMW73oPTKX8ERphcaSNvHjtv5x/goRd8LTKdKsYUC9KcX 2jGZBF2cACqjwZ7bGs18vHeYJitFmPqSaAYLfgsgR8YgLI/OtpYE/+J3NCMBu+2+nuP5frXeage 2i3mve0iJAihmmaNyVgmHnBRBZfQt7gmwjKFWzXgoeYHkrXglaIgmZ+WDm2587Jca18f3l5GjqV gw/+9gOwgyDULB0Zd5IlpXpV2UveSxRK0V2a7Zy7ZswgvkEJ2B3O58b1Mj3ZLAvyoA8zE8gMX7M XjX3BGnXQUc4WsW4oV8gTO6U0ikRVQsFrZJrmOPMpMw6hBOE4IH8FO/IQEkhtbMOY77JyZM7ZgT sdIEmKyqdpdo5ZBajNCYWNPSIRfObLcTaI9asgN/A8Vk45Tyk+kbmMVEHepxuH5aeG6yPtgsUmX k6ZO4RRfH0YUAv+Un8kF5H3WDyp+0DLw+j6UVd5KYj76HW1RRIjsiz6aYt1dmtJUtDSuyLR98kF cQwpaW4y9XygyG+5hrGG+ryM/iyX/VSi80mn88DnAsltFevtF3E0DN+JLv7Nlc5753vZ8yLGEMk GbWVrtEftfskHVdtyW53qtIcT8zlMQr/YJS6VSO1yVuixyo= X-Received: by 2002:a05:622a:1c17:b0:536:622d:6932 with SMTP id d75a77b69052e-542b62a4588mr193626811cf.23.1793672942811; Mon, 02 Nov 2026 18:29:02 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:35 +0000 Subject: [PATCH net-next v3 09/15] net: skbuff: reject data_len > len in copy_and_csum_dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-9-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672923; l=1669; i=josef@toxicpanda.com; h=from:subject:message-id; bh=BXekQ+0ZZcw4R6M9C7rnaESTyK2ZJqIQSa++cyygjWo=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QNn8OCjsMCbSYh7N8mCbl9Otj5ltaFziZ7io28rIRlQmVoNauFULhcxK6cWv8CNZSqiLp0sSE2u sJ/9L7jVi1w4= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-16d1c6/1793672944-F580D77B-D389F653/0/0 X-purgate-type: clean X-purgate-size: 1671 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672975980158500 skb_headlen() is len - data_len in unsigned arithmetic, so it underflows to about 4GB for an skb whose data_len is bigger than its len. skb_copy_and_csum_dev() compares the checksum start against skb_headlen(), so its checks don't catch such an skb: - Without CHECKSUM_PARTIAL the checksum start is skb_headlen() itself. On 64-bit the 4GB value becomes the length of the linear copy. - With CHECKSUM_PARTIAL any checksum start below len passes, whatever the linear area really holds. The BUG_ON() that commit 56453199d28f ("net: skbuff: don't BUG() on a bad csum_start in skb_copy_and_csum_dev()") replaced compared against the same value, so this isn't new. No path is known to build such an skb. Check for data_len > len before anything uses skb_headlen(), and zero the frame. Link: https://lore.kernel.org/all/179273112823.3134.12241973533522574538@ke= rnel.org/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index e400990595f8..b74d8a6ef0f9 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -4165,6 +4165,15 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb= , u8 *to) __wsum csum; long csstart; =20 + /* skb_headlen() underflows if data_len is bigger than len, and then + * the checks below don't bound the copy from the linear area. + */ + if (unlikely(skb->data_len > skb->len)) { + DEBUG_NET_WARN_ON_ONCE(1); + memset(to, 0, skb->len); + return; + } + if (skb->ip_summed =3D=3D CHECKSUM_PARTIAL) csstart =3D skb_checksum_start_offset(skb); else --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672963; cv=none; d=zohomail.com; s=zohoarc; b=G+CNzaagC2hk3aqiBq2dtTF0410o7hCkFDTCJewY+cBrPJvZ3cM9PA/qhehnfxrURCYswPzxbFVhPNBH9hyeUMWbcgklpTMxOoGg0pCMxcZFmdkWPkwHOXLHpxHaaf2hlzx7KIOHRKVN4FlHCzA3cJ7BJ8m9rPK7DVZFGiomn6s= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672963; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=JVitIrAzmZ42ioJp40YLaoRa+dPpR6cnKnn2NFUMG3c=; b=AbkcNsQRDJJYZ170fQ1G2n10pBhyS05QK8E85xlURnjcxdHQlEfWncgo6kIHEABLfGsVH8V+tja2pemgT9Pq8w/pU95P5mpZU2EKAvy+M+ZkS0c2madDPch9OlXWtQ2mLT/pgbZEVe9+uiVurUFHiCErBy7QOsLQoe7M/gbuSeY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672963920308.6694437483876; Mon, 2 Nov 2026 18:29:23 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468944.1678005 (Exim 4.92) (envelope-from ) id 1xO4Gr-0000q5-0o; Tue, 03 Nov 2026 02:29:09 +0000 Received: by outflank-mailman (output) from mailman id 1468944.1678005; Tue, 03 Nov 2026 02:29:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gq-0000ph-Sh; Tue, 03 Nov 2026 02:29:08 +0000 Received: by outflank-mailman (input) for mailman id 1468944; Tue, 03 Nov 2026 02:29:07 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Go-0000WY-RJ for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:29:06 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Go-00CYCC-81 for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:29:06 +0100 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae94690-e002-0a2a0a5209dd-0a2a450cec40-24 for ; Tue, 03 Nov 2026 03:29:06 +0100 Received: from [209.85.219.52] (helo=mail-qv1-f52.google.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946f1-f479-0a2a450c0019-d155db34ad6c-3 for ; Tue, 03 Nov 2026 03:29:06 +0100 Received: by mail-qv1-f52.google.com with SMTP id 6a1803df08f44-91befe703c4so35781176d6.1 for ; Mon, 02 Nov 2026 18:29:05 -0800 (PST) Received: from toxicpanda.com ([153.61.196.253]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91ca7f25fb7sm106263956d6.12.2026.11.02.18.29.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:29:04 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672945; x=1794277745; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JVitIrAzmZ42ioJp40YLaoRa+dPpR6cnKnn2NFUMG3c=; b=TQGRsVfW61VePD3w4SItIxDX1ZECispDhhGtAdwSc3UePCBEoMnwIs4DWczGkwmRHT MaDP2JIr9B5HURL5SHfsRf8asF2vKY6F1krOPMqZ51cP7rj1GtnvsDFNXHwTU8PSLndw potpjwS7t6m2DMGjTA2Y5ormLZQTEPRxcdhFgdPk1ZX4R3BxVJ6wg8pV/z8NyzqXtSjW yC+jaJBakckGbwfB1pLL/jpSpf3Wuy/lAa1TX3mCjI9/LessfXSe0c8YdTPt5xHAbCdo F39mnAaNwLfXnG5TxmIZhn8HXwVfhzbfEiIvW/CoD3J/V/HUC7MKdtFvloHIhuEwFr5S ljcQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672945; x=1794277745; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=JVitIrAzmZ42ioJp40YLaoRa+dPpR6cnKnn2NFUMG3c=; b=PkeB/xqICjKKn0A0P3+YHtjaaEJrj0YUFObi6AAuVVXaYMpS8kow/XvuG3iqoNgDzX +SSqP8goHC/FOjtDFQ6OhZdMR/HD1FegCSwAJudBnHdB//oBVUlqL0rhxXP1hF2kEnXq I6E31NFYHVhdiiVnqZJE9aCvjeTkjsxEUx193xkRKU0j7n+CFed0gx5Ww4zMrkgNijsp QDucPWX/jbg2T6k0lXXkL058dlDoxFfLv9l2jGaF2Idvf+tnOhgUwv3DpdMVqdtafRhj B0DlmwipwZBa7ueBPF5Lo7Yaecy38tp4womqztzCTLbG8mSHRMrWUeLXdxEssZQFB6L9 VSjg== X-Forwarded-Encrypted: i=1; AKwUvByX2FYcsddqHKuZwmZco+YS76z8M/hyV5LtWafi+q8FfeRXg5QwO743SOkaocaBJZa/6NW/Jx5Ze7w=@lists.xenproject.org X-Gm-Message-State: APuU4Z+P1oEUHNKSooNveYPhVQP+vSRLa/ctmlinEBTsx2cA54e2Al++ gBCP6Wld/gHC/1RQjWe1HNAOKppVgHL/K9EYZotzryTdSBizLTnzLDGSguj2fnU74qE= X-Gm-Gg: AYBFou2oaWWao2AE7iWohRAPMPLgOutF814NmhOk9wZtuSmesEVO/Gwz9BgqHEbYFo/ Ep62sOEHatZmFAPBTQ9eLjbEeqt+pgpT9LvRQ434Mo6ypgUspuUC5wXdSjCKVql1LNSFLrBpjiP +wnUaxjBt1Mgv0rs/MVuy0GHUxmGn7xpWNK42oEAOYRhwCtDrd0Hl9kgRMSgpDxK3sRP/ho92wX FHcBKTKgj4huDZV7EJt2PK9SqEPdZoIzf9smhs8TtbyhVYAsE/xMJ0+kgq7liVYmiSw++/QmxoS Wqe3hXtG9joChb//zlnT1NRU7I2K11eAA0B7XAcsqpgJmhFW8d68A1cwFaS8kvWApAdpvQV7IW7 piFF73aqz6SKlQiO14Yvdqirgwfk5DYutzhcA6Ac0KEM9QV/kDrCzl6o/0QuMjXBGAb7WgHqjEa iu+s3/mC981BRrRY/EElyLr6OvSjnTv1pGSp/T2AhX7qWtFcwdHoqhl6olhU+F1Vn/qC9AnPg1C o0pH7ZZo/rG4IKoJCe5y+PZ7nSfOQSLO/p8vDXvz6TxCGCT7ro2AhA8m/a2cb6KZy0a5XDAs7Af 23Bf8fqWo3J1ia0m3q6bulJXQjtxx9MpU3luzNkhJw+hYQ== X-Received: by 2002:a05:6214:d65:b0:91c:8fa6:1789 with SMTP id 6a1803df08f44-91ca4b92fdcmr194775386d6.28.1793672944680; Mon, 02 Nov 2026 18:29:04 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:36 +0000 Subject: [PATCH net-next v3 10/15] net: skbuff: reject a negative length in skb_copy_and_csum_bits() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-10-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672923; l=2784; i=josef@toxicpanda.com; h=from:subject:message-id; bh=PruTOHBwv5dTjTwNqILcr1QH0bLKSEEDfj9BCJzaYZc=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QN22JQgoXgrJiR5yAYHNf+ITF3NfM8ygPUQ+LdAZK32fRjNubeEAAV9Ib7v/7F/D7ljAdUlHQzF J2Sm3nsf4Vgw= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d25034/1793672946-03ED2A5B-1BF45C0D/0/0 X-purgate-type: clean X-purgate-size: 2786 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672965866158501 The head, frag and frag_list copies in skb_copy_and_csum_bits() each clamp their length to @len. A negative @len from a broken caller therefore becomes the copy length, and the copy takes it as a huge unsigned value. The two len > 0 tests around the zero-fills only protect the zero-fills. Reject a negative @len on entry with -EINVAL and drop the two tests. @to isn't touched in that case. Every caller already handles an error, and skb_copy_and_csum_dev() zeroes its whole frame on one. No caller is known to pass a negative length. Found by the Sashiko AI review of the BUG_ON() series. Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f73289= 5b@toxicpanda.com/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index b74d8a6ef0f9..e3fc6291d223 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3731,8 +3731,7 @@ static noinline int skb_copy_and_csum_frag_list(const= struct sk_buff *skb, if (unlikely(len)) { DEBUG_NET_WARN_ON_ONCE(1); /* Don't hand the caller a buffer with stale bytes in it. */ - if (len > 0) - memset(to, 0, len); + memset(to, 0, len); return -EFAULT; } out: @@ -3748,9 +3747,10 @@ static noinline int skb_copy_and_csum_frag_list(cons= t struct sk_buff *skb, * @len: number of bytes to copy * @csump: where to store the checksum of the copied bytes * - * Return: 0 on success, or -EFAULT if @skb has unreadable frags or runs - * out before @len does. On failure *@csump is not set and the part of - * @to that couldn't be filled is zeroed. + * Return: 0 on success, -EINVAL if @len is negative, or -EFAULT if @skb + * has unreadable frags or runs out before @len does. On failure *@csump + * is not set. On -EFAULT the part of @to that couldn't be filled is + * zeroed, and on -EINVAL @to is not touched. */ int skb_copy_and_csum_bits(const struct sk_buff *skb, int offset, u8 *to, int len, __wsum *csump) @@ -3760,6 +3760,14 @@ int skb_copy_and_csum_bits(const struct sk_buff *skb= , int offset, int pos =3D 0; __wsum csum =3D 0; =20 + /* Everything below clamps its copy to @len, so a negative one would + * turn into a huge copy. + */ + if (unlikely(len < 0)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } + /* Copy header. */ if (copy > 0) { if (copy > len) @@ -3775,8 +3783,7 @@ int skb_copy_and_csum_bits(const struct sk_buff *skb,= int offset, =20 if (!skb_frags_readable(skb)) { /* Don't hand the caller a buffer with stale bytes in it. */ - if (len > 0) - memset(to, 0, len); + memset(to, 0, len); return -EFAULT; } =20 --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672976; cv=none; d=zohomail.com; s=zohoarc; b=JjalMYIGHHs8pZ53n9oN4DEKlV5YeaZeh6ukd1j8fWxcJHzdM6fFMA1lvapVovtctjR8KGi1DnsKM6P07gidM/HTd//LXkFXyA2irV59zbp5EO5Ak5XAOJWVhvzkiBl4WvulzhMhCEYz2fNEt3mkpTzemu7VPywf8Yj8JKxW70M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672976; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=beA32Wl5uGeVdDRquUg9onzNEjLmSlivsd983Tz/Vmc=; b=De87AvtzLhwbAm9pvr1nzg4Miq4Ap+h6dr79cBVdbmJMgya3oSZ+yLwgCRIJJj1SJIgs7rqOOnrpa52VyKz8aT7bwW/iSvc930Q6pMPWHT2wIiI7TFZhpFnTHOVzFybuMAWwCpgJEVEFzm7r+tyy0NldCYnFcak4L/N/my0xbI8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672976414711.9299449773431; Mon, 2 Nov 2026 18:29:36 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468947.1678014 (Exim 4.92) (envelope-from ) id 1xO4Gs-00016b-KH; Tue, 03 Nov 2026 02:29:10 +0000 Received: by outflank-mailman (output) from mailman id 1468947.1678014; Tue, 03 Nov 2026 02:29:10 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gs-00015y-Ee; Tue, 03 Nov 2026 02:29:10 +0000 Received: by outflank-mailman (input) for mailman id 1468947; Tue, 03 Nov 2026 02:29:08 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gq-0000os-P6 for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:29:08 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gq-00BP11-5y for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:29:08 +0100 Received: from [10.42.69.2] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae946df-bab6-0a2a0a5309dd-0a2a4502d736-24 for ; Tue, 03 Nov 2026 03:29:08 +0100 Received: from [209.85.222.173] (helo=mail-qk1-f173.google.com) by tlsNG-720697.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946f3-6ca4-0a2a45020019-d155deadc0b4-3 for ; Tue, 03 Nov 2026 03:29:08 +0100 Received: by mail-qk1-f173.google.com with SMTP id af79cd13be357-93f22a8515eso350685085a.2 for ; Mon, 02 Nov 2026 18:29:07 -0800 (PST) Received: from toxicpanda.com ([153.61.196.254]) by smtp.gmail.com with ESMTPSA id af79cd13be357-94425ac5322sm974378785a.39.2026.11.02.18.29.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:29:05 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672947; x=1794277747; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=beA32Wl5uGeVdDRquUg9onzNEjLmSlivsd983Tz/Vmc=; b=MIVy3/0sBd1CCo+yd20XI3EDIHDtOeHsAt9I3WRZjR6qRIKFoVQbVHc4uQUmse5rU6 vpT09fpdavPkLlzyFTY/b0FqA1DhV0HfW/uIldt+0/azSKTddXZBYiLqYY9O/gBlYhe/ ewFkizTnzGK6GMOMQXOarmQfa1IjLJL5sahxyy94MBdy5WMhACHxYBf4/7DkrO+SmRtj M2ghZeM9rLnLmC3LIizqm4g6D9dQ6/aERPd+jtIA6dwkpIFmzlpeQ7YYGeCrHz0aV/KF XAgosV3F1kWG467TbHmGr6tSyd+cP51mQ/ynjaA8naVqi+F4YnOUWqfUIZS/mqUoRCXK ekUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672947; x=1794277747; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=beA32Wl5uGeVdDRquUg9onzNEjLmSlivsd983Tz/Vmc=; b=lBvoRlpIsX96pfnJP2QI55hojGMrhd9+Os7xJhe1q8OcaIQ81QtZeSUMm26SRZlgNg axQohsPn+5CqyC190cghh//7Tjrg/wlOjB5YmeN+tEVhxKDcY+5jXsYXtXSFf3+T2rFN VKBPTEOP6SmfnDsD/uLmhZgDv5T4RvjNDxZqqzzCb5hGkQ4qEvoZJFDgh9+ViGIeefQb SE6pxMiqHdybTjYiU5zMEHv8qiJA1xN+Yj/3EPXypDTJWLcp1sMO8+iQXZF5G15+mTLc M166AFU48LDY3Uopw246ScrdxfH0BjpWqLWjnaP5Y1VhXGXKiusABJsAv0isd40kKNf8 BVLA== X-Forwarded-Encrypted: i=1; AKwUvBy+9F/W8+zlyBRu20ABmYruvES1SQwhcBMm5UT5GDkOLurON20XSFArz4LTf/EPu1hF6lhd4i4bsfQ=@lists.xenproject.org X-Gm-Message-State: AFq9FYImJsSLEIOXASdemLk0XFXUzkbCuRyu1fYDkmVW9XbwyafbZVca bTFUnZqqlxm9Qkp6DYELtEN7C72bM0+LBW8uwkk1IJOt7SzsC2qNaC851Alce9BXBwg= X-Gm-Gg: AYBFou09tXr85cOsgdoARSwfvbLxWItThftVKzpF6AAMw4bvPLFpY2cZT37gSciKpEq KabFMeYEPHUPRgtNgzitZZegebk4CD1y2l4eiCsY+uptrkFRPxKrN2Nna7PbWDSENTsAK6zHts2 +dfU0TxHKqW33+BxPWOOQBJyRK+T66SXiFZ2H/tOi43seeOcvioB++FC/eny8RyBfLolz4bkcR3 7loAnhncJFvaNmXuAdFtyZzUi0x6HYMSaYiHg2uRXGEanKbNyQ3+3J1Kj+qAsEDMWagjRt4Tb/1 lE7ugdwtHJhKX9IeGepVoV3cg/il01P+V+7L+M7bfUj4VOpZTKoIbhc3U+kP2ZliV+9HGdXtQ5+ 04rf9i4QqNW/CDL9aD8hW9A7ZkWmI6o2GjBArFxaqfmbxQ8T4fgX4LPbo9iMoM9iJ0oMhO3QXQg BaHkJyqMKO+BkoUpSBx7SZqsLY61gv2xV1sME7/GiGKYDP3+cmsEa9KAITKN6lkesxb/9jNa5yw B0YvWRT//xHk2yaU81jrYQbpqkQYNDdPP5SGicU1Lv/sjJGUtrOb8gVHuXFsUM8tIXCe/cBq9TY Qe/9zAaayfgZL2IAck5HQ624s8Dm/JrfZJ2xRUWl8Z+fKw== X-Received: by 2002:a05:620a:2b43:b0:93d:92a9:1a5e with SMTP id af79cd13be357-94421799683mr2059957985a.37.1793672946476; Mon, 02 Nov 2026 18:29:06 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:37 +0000 Subject: [PATCH net-next v3 11/15] net: skbuff: don't run off frag_list in skb_segment() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-11-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672923; l=3043; i=josef@toxicpanda.com; h=from:subject:message-id; bh=ZFtZ+wZ1/BRwvrFDewd6GJQ8sWu7jAVgTMehQH1Him4=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QF1JASk2FaQ2hzp9j2Mg5ifJ5XQ/M7YFkqH/XBR1KN5aCYeKq0yVaHYAgZGVZBKc6lSw+ESgzWk 7uQyVrofUxQU= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-720697/1793672948-31BC82AC-DCA57C44/0/0 X-purgate-type: clean X-purgate-size: 3045 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672978071158500 skb_segment() keeps going until it has segmented head_skb->len bytes. It takes the data from head_skb and then from each member of the frag_list. If head_skb->len counts data that this walk can't find, the walk runs out of members while it still owes data and dereferences a NULL list_skb. There are two ways to get there: - head_skb->len is bigger than what head_skb and its frag_list hold. - A member has a frag_list of its own. head_skb->len counts those bytes, but for each member the walk only looks at the linear part and frags[]. No path in the tree is known to build a GSO skb like either. GRO flushes instead of chaining an skb that already has a frag_list. IP reassembly does nest frag_lists, but a reassembled skb isn't GSO. Check list_skb in the three places where the walk moves on to it, and fail the segmentation with -EINVAL. The KUnit cases in the next patch hit the NULL pointer dereference without this patch, and at least one of them hits it again with any one of the three checks taken out. Without SG the payload is copied by helpers that check the length themselves and recurse into a nested frag_list. That path still fails for a len that is too big, and still segments a nested frag_list. Found by the Sashiko AI review of the BUG_ON() series. Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f73289= 5b@toxicpanda.com/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the Reviewed-by: Willem de Bruijn --- net/core/skbuff.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index e3fc6291d223..b2c44a58db23 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5164,7 +5164,16 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, int hsize; int size; =20 + /* list_skb runs out early if head_skb->len counts data that + * this walk can't find: bytes that aren't there, or a member's + * own frag_list, which the walk never looks inside. + */ if (unlikely(gso_by_frags)) { + if (unlikely(!list_skb)) { + DEBUG_NET_WARN_ON_ONCE(1); + err =3D -EINVAL; + goto err; + } len =3D list_skb->len; } else { len =3D head_skb->len - offset; @@ -5174,7 +5183,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, =20 hsize =3D skb_headlen(head_skb) - offset; =20 - if (hsize <=3D 0 && i >=3D nfrags && skb_headlen(list_skb) && + if (hsize <=3D 0 && i >=3D nfrags && list_skb && + skb_headlen(list_skb) && (skb_headlen(list_skb) =3D=3D len || sg)) { if (unlikely(skb_headlen(list_skb) > len)) { DEBUG_NET_WARN_ON_ONCE(1); @@ -5294,6 +5304,12 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, =20 while (pos < offset + len) { if (i >=3D nfrags) { + if (unlikely(!list_skb)) { + DEBUG_NET_WARN_ON_ONCE(1); + err =3D -EINVAL; + goto err; + } + if (skb_shinfo(nskb)->nr_frags && nskb->pp_recycle !=3D list_skb->pp_recycle) { nskb->data_len =3D pos - offset - hsize; --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672966; cv=none; d=zohomail.com; s=zohoarc; b=iJuPnn4hzQboibNkW78/SL17VXHssAmMtL9arbVoT2/9IlJp6lTEhGRh4IUz4BGidRne58ebapUqRgHlTnxPqggKoa4XSXPg7nfySmA2/eFJG+q4ISshPPs3ocMVVV6/98rk6jCNY0XK2hLoqvqkWto/2Bnf8LDV0wWrrJ6StlQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672966; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=MseyG3+pKKIruXhcv710BgM8fgKq/guu+mQy13emKdo=; b=cdrsXKeAyZeHEatI4Rh9xYdvbGPdSWG/a+4Nsiv3rPDYQhLqEHnkUPXPIpFf0idT4fSpM+xlUwBHk0OtqP/k8emvf24aYETzYlvdOZq4b3sfJ1QgZMdOpNAOeKLLu5xQMLxO2TrUfL45gXOpqO46AEZV42ZXCK+3zGSKXfijqAc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672966958643.8653548774827; Mon, 2 Nov 2026 18:29:26 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468949.1678023 (Exim 4.92) (envelope-from ) id 1xO4Gu-0001N9-3j; Tue, 03 Nov 2026 02:29:12 +0000 Received: by outflank-mailman (output) from mailman id 1468949.1678023; Tue, 03 Nov 2026 02:29:12 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gt-0001MZ-Sv; Tue, 03 Nov 2026 02:29:11 +0000 Received: by outflank-mailman (input) for mailman id 1468949; Tue, 03 Nov 2026 02:29:10 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gs-000142-Da for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:29:10 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gr-00CYCC-Qg for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:29:09 +0100 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae94690-e002-0a2a0a5209dd-0a2a450cec40-26 for ; Tue, 03 Nov 2026 03:29:09 +0100 Received: from [209.85.160.175] (helo=mail-qt1-f175.google.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946f4-f479-0a2a450c0019-d155a0afe483-3 for ; Tue, 03 Nov 2026 03:29:09 +0100 Received: by mail-qt1-f175.google.com with SMTP id d75a77b69052e-53cd0c8614eso28050841cf.0 for ; Mon, 02 Nov 2026 18:29:09 -0800 (PST) Received: from toxicpanda.com ([153.61.196.253]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5498b49ce1dsm13814311cf.5.2026.11.02.18.29.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:29:07 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672948; x=1794277748; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MseyG3+pKKIruXhcv710BgM8fgKq/guu+mQy13emKdo=; b=UDvQf9nq8EcsxThyEuq1CbS0swoqeQQgHLSzrZpNj8wjU4/l1mMSRNrgaxMQSpNasu oKsmMY67U8okM/ibsygnwzUUFqozXMQST9pHIvsbOnNzrPxHw9iLkw1bPOGi5Du9Lp2f XFjyJitMuNM3zIRLDKRk08kzBSY8IhT2f8WFTNcUwU89SX8Iw/3/CfQLYlWTVA2ZdsTh +UHuZE4UEJTK4UOdibkZic7r6VTCDGm86vH74p9X+UeF1ilk7zBo6N0mdihpBl12SK/n mHdd54s1dQoqW+QxFOllSc6sj8LTTuRt189dJS+HdzWLAbc+2dX/o6DY/xK9IPab8YIm e9fw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672948; x=1794277748; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=MseyG3+pKKIruXhcv710BgM8fgKq/guu+mQy13emKdo=; b=yQ+QFe1lya6II1UqlC7Txeseg+VBXYKXHON1swEW/FU2SBxmTJM3Rcm3Xbmgf3qNeL QDomOoKpbd2X2Y9/mYVPU2m5Kj3cNA2HrTlMVYpQnc6zx6AzFB4LEk/+o8gd00wxDIC5 tvBvxc6wOeFkW4gtZYyRtsNZ/8Q/rBbV3sl1s0RX47eNl8CMzlCFOm9NeDGOnD/1q6Y0 9Ut4Tr8BvM5fKW0I3r8Z/nMY6exrMIEFVrB1FWHd1iV3Wggni+tcPFatU6hbbHEU3g7u 3mEwbCrq9eUdwqWNWkjf+eTyZbsDUJBE7mW6a7brohcJW4SwbF6lFQittZ5CAkCA/TGJ qulg== X-Forwarded-Encrypted: i=1; AKwUvBypcZ3D5GbBNR8ONNtzzGQ4MFjqNnCD5JtX9LaLM8HAGhVbQen/LIn3yD+n0W4hfoErP5mX737q2l8=@lists.xenproject.org X-Gm-Message-State: APuU4Z+uZsukGHq0THSwKzbR8cFDLwmGZtfwRj8X9UDvfAHNl06XVJgm qinsH8PB82KfatnkZ59FL47qDneSLOukJes6ffblFRAhfkIu3OZFkZLMtR0JkQxTDdI= X-Gm-Gg: AYBFou1C1TrieimN2J0MowNdjx9Zj/dpGbH6TYpMTqUoII15HkqM8F+sMj2dK6bd5sQ eib3c5gntpsFQOnoI06vMXBKpko2FSnC/CUToRgIy/xlrVtvNv2hJahmfJVW6TReNPlL3Nw6ZMZ 4kA82On0Jxgb6rsIToXS0/tokz2qhaYWNl9lF1Bs31N2nn1s9v0IT/KArCGgPWL8ND5i22Ou6D9 JlFwi2MBbvuYpTrutAQgCsbTfTVXgCpt+fMQQnTadyp3VwV8Ajo50Rk6OF8tTc50YHry6yYPGVA YnDz0a9aUrj0X3/LA65wTdG+naB6ScGx/nXG38cDcRkcHG8Tj44iwGTJqwdokeT9O6hbAdGQY/k nojNJ8SeXqFWygt56191DP25crH5sWQRYlrJRocMZY3k2T0i7ikqr+6rK9yAB7osApc8TJCqA+1 RxU1MGlJEgMe2sXyR8p/DApOTpbvWk0scmQd4t6pYdDISw1DCAYuitlpSS44xz1qOF1K1zw3C+C bHkHXg+SuHdRcyLeYcWo2scapJ+v0N3MEtNfAyGWbyADJ/9Gn7hWGKPMtxC13i6kf3Z39pq9mKG 4u1R3FdbI3fbTWOA8oEHevGKxbkllMFI8xThqmV6tHt0AA== X-Received: by 2002:a05:622a:250e:b0:535:a5fa:ee05 with SMTP id d75a77b69052e-542b7ff0369mr187387061cf.69.1793672948244; Mon, 02 Nov 2026 18:29:08 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:38 +0000 Subject: [PATCH net-next v3 12/15] net: test the skb layouts skb_segment() refuses MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-12-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672923; l=5235; i=josef@toxicpanda.com; h=from:subject:message-id; bh=/VgW0oW9T+Tzy+i1BGO6eU3AucNR1Ntg0slpO9Mj98E=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QKMmn6TBuIrBkysKogxABEz6HQG1Via38Q+vUl7yCgJi2hIoaEjJWJRzWZW20ii4tSe3afYAeZ4 ExrUaw3kh8Ao= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d25034/1793672949-020C1A5B-F8DA71D8/0/0 X-purgate-type: clean X-purgate-size: 5237 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672967856158500 The GSO KUnit test only checks layouts skb_segment() can segment. Add the ones it has to refuse with -EINVAL: - The non-uniform frag_list with SG on, which used to hit the BUG_ON(i >=3D nfrags) the existing test steps around. - A frag_list member that has its own frag_list. - An skb whose len counts bytes it doesn't hold. The data runs out on a segment boundary, in the middle of a segment, after the last frag_list member, and with GSO_BY_FRAGS. They warn on CONFIG_DEBUG_NET kernels, so run them with the warning backtrace suppressed. Also update the comment on the non-uniform case, which still says SG would hit that BUG_ON(). Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the Reviewed-by: Willem de Bruijn --- net/core/net_test.c | 98 +++++++++++++++++++++++++++++++++++++++++++++++++= ++-- 1 file changed, 95 insertions(+), 3 deletions(-) diff --git a/net/core/net_test.c b/net/core/net_test.c index 2b5080c22663..298ca240104c 100644 --- a/net/core/net_test.c +++ b/net/core/net_test.c @@ -41,6 +41,12 @@ enum gso_test_nr { GSO_TEST_RESEGMENT_MULTI, GSO_TEST_RESEGMENT_TAIL, GSO_TEST_RESEGMENT_ONE_MSS, + GSO_TEST_FRAG_LIST_NON_UNIFORM_SG, + GSO_TEST_FRAG_LIST_NESTED, + GSO_TEST_SHORT_LINEAR, + GSO_TEST_SHORT_LINEAR_STRADDLE, + GSO_TEST_SHORT_FRAG_LIST, + GSO_TEST_SHORT_GSO_BY_FRAGS, }; =20 struct gso_test_case { @@ -58,11 +64,16 @@ struct gso_test_case { unsigned int gso_type; /* skbs from alloc_skb() instead of build_skb(), head_frag clear */ bool no_head_frag; + /* bytes that skb->len counts but the skb doesn't hold */ + unsigned int missing_len; =20 /* output as expected */ unsigned int nr_segs; const unsigned int *segs; const unsigned int *gso_segs; + + /* skb_segment() is expected to fail with this error */ + int err; }; =20 static struct gso_test_case cases[] =3D { @@ -241,6 +252,61 @@ static struct gso_test_case cases[] =3D { }, .gso_segs =3D (const unsigned int[]) { 0, 0, 0, 0 }, }, + { + /* frag_list members that don't end on gso_size boundaries + * can't be segmented with SG + */ + .id =3D GSO_TEST_FRAG_LIST_NON_UNIFORM_SG, + .name =3D "frag_list_non_uniform_sg", + .linear_len =3D GSO_TEST_SIZE, + .nr_frag_skbs =3D 4, + .frag_skbs =3D (const unsigned int[]) { GSO_TEST_SIZE, 1, GSO_TEST_SIZE,= 2 }, + .err =3D -EINVAL, + }, + { + /* the second frag_list member hangs off the first one's + * frag_list instead of off the head's + */ + .id =3D GSO_TEST_FRAG_LIST_NESTED, + .name =3D "frag_list_nested", + .linear_len =3D GSO_TEST_SIZE, + .nr_frag_skbs =3D 2, + .frag_skbs =3D (const unsigned int[]) { GSO_TEST_SIZE, GSO_TEST_SIZE }, + .err =3D -EINVAL, + }, + { + /* the data runs out on a segment boundary */ + .id =3D GSO_TEST_SHORT_LINEAR, + .name =3D "short_linear", + .linear_len =3D GSO_TEST_SIZE, + .missing_len =3D 50, + .err =3D -EINVAL, + }, + { + /* the data runs out in the middle of a segment */ + .id =3D GSO_TEST_SHORT_LINEAR_STRADDLE, + .name =3D "short_linear_straddle", + .linear_len =3D GSO_TEST_SIZE + 500, + .missing_len =3D 700, + .err =3D -EINVAL, + }, + { + .id =3D GSO_TEST_SHORT_FRAG_LIST, + .name =3D "short_frag_list", + .linear_len =3D GSO_TEST_SIZE, + .nr_frag_skbs =3D 1, + .frag_skbs =3D (const unsigned int[]) { GSO_TEST_SIZE }, + .missing_len =3D 50, + .err =3D -EINVAL, + }, + { + .id =3D GSO_TEST_SHORT_GSO_BY_FRAGS, + .name =3D "short_gso_by_frags", + .nr_frag_skbs =3D 2, + .frag_skbs =3D (const unsigned int[]) { 100, 200 }, + .missing_len =3D 50, + .err =3D -EINVAL, + }, }; =20 static void gso_test_case_to_desc(struct gso_test_case *t, char *desc) @@ -337,21 +403,47 @@ static void gso_test_func(struct kunit *test) skb->data_len +=3D total_size; skb->truesize +=3D total_true_size; =20 - if (tcase->id =3D=3D GSO_TEST_GSO_BY_FRAGS) + if (tcase->id =3D=3D GSO_TEST_GSO_BY_FRAGS || + tcase->id =3D=3D GSO_TEST_SHORT_GSO_BY_FRAGS) skb_shinfo(skb)->gso_size =3D GSO_BY_FRAGS; + + if (tcase->id =3D=3D GSO_TEST_FRAG_LIST_NESTED) { + struct sk_buff *first =3D skb_shinfo(skb)->frag_list; + + skb_shinfo(first)->frag_list =3D first->next; + first->next =3D NULL; + first->len +=3D tcase->frag_skbs[1]; + first->data_len +=3D tcase->frag_skbs[1]; + } } =20 + skb->len +=3D tcase->missing_len; + skb->data_len +=3D tcase->missing_len; + features =3D NETIF_F_SG | NETIF_F_HW_CSUM; if (tcase->id =3D=3D GSO_TEST_GSO_PARTIAL) features |=3D NETIF_F_GSO_PARTIAL; =20 - /* TODO: this should also work with SG, - * rather than hit BUG_ON(i >=3D nfrags) + /* TODO: this should also work with SG, rather than fail the + * i >=3D nfrags check in skb_segment() */ if (tcase->id =3D=3D GSO_TEST_FRAG_LIST_NON_UNIFORM) features &=3D ~NETIF_F_SG; =20 SKB_GSO_CB(skb)->max_segs =3D tcase->max_segs; + + if (tcase->err) { + /* the suppression block doesn't run if it can't be set up */ + segs =3D NULL; + kunit_warning_suppress(test) { + segs =3D skb_segment(skb, features); + } + KUNIT_EXPECT_EQ(test, PTR_ERR_OR_ZERO(segs), tcase->err); + if (!IS_ERR_OR_NULL(segs)) + kfree_skb_list(segs); + goto free_gso_skb; + } + segs =3D skb_segment(skb, features); if (IS_ERR(segs)) { KUNIT_FAIL(test, "segs error %pe", segs); --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672985; cv=none; d=zohomail.com; s=zohoarc; b=Tax5/Il3tbyGqk5zENMI6SmrnWbFjBkWA+eA6iK8XFCOn7VGoazASgCgCJgQJnf5sZycA9RXf+sPMznBr56Eu2vODAbJJv7DOAw4BbzoMFG1zkgSEKjDZMhSY7r0g5d6rNjWC05277mP1gyGdSPthuOQKRa+DB9vTL1KciT2Z1c= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672985; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=EA63ABVwcLs3h/JxipVqiXIy94JHS7osXg+Mm97gaVg=; b=eVUkcJrCLyRi13XnQkM3+9K8o7IhyLCAifRxIOYHjvM8bkx81FNQqhRFfR2Hh5YX3xdX38+f/1LdRXG50jCidIzRuowQSYnptS36kgt58+JgHgU5t386C4vIfnn6M9bOaycyAPYNv9ODxo1J3qIAKasKJDM2YZqz74jcJvuRuag= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672985290192.39839346362305; Mon, 2 Nov 2026 18:29:45 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468951.1678033 (Exim 4.92) (envelope-from ) id 1xO4Gw-0001qk-F6; Tue, 03 Nov 2026 02:29:14 +0000 Received: by outflank-mailman (output) from mailman id 1468951.1678033; Tue, 03 Nov 2026 02:29:14 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gw-0001pv-6J; Tue, 03 Nov 2026 02:29:14 +0000 Received: by outflank-mailman (input) for mailman id 1468951; Tue, 03 Nov 2026 02:29:12 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gu-0001N8-5S for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:29:12 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gt-006j9s-I2 for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:29:11 +0100 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae94693-8faa-0a2a0a5109dd-0a2a4503aa56-20 for ; Tue, 03 Nov 2026 03:29:11 +0100 Received: from [209.85.222.172] (helo=mail-qk1-f172.google.com) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946f6-fae8-0a2a45030019-d155deaca873-3 for ; Tue, 03 Nov 2026 03:29:11 +0100 Received: by mail-qk1-f172.google.com with SMTP id af79cd13be357-93a40a9a01aso30472685a.0 for ; Mon, 02 Nov 2026 18:29:11 -0800 (PST) Received: from toxicpanda.com ([153.61.196.255]) by smtp.gmail.com with ESMTPSA id af79cd13be357-94425ae63fesm971577285a.42.2026.11.02.18.29.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:29:09 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672950; x=1794277750; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EA63ABVwcLs3h/JxipVqiXIy94JHS7osXg+Mm97gaVg=; b=r5NeNFlV1L7VjnbdnNqDXC+22zl16zqJGUDtHUfHgXv7SCamPlIZDejoJGrmAImOVj y3sODP7vLXt1HTuhaR0HQPBUYEoZQcIod/Yd3BW/ysT7h6RaVSqQCAMtw7Ql3srEe627 rAvSe5QMaWeySkdrYSxi4hubR/OJAT0LgVWHcDRaNZa1Rc5VQC8Ug6X8hHZoPV0F7L49 3JwnNYjIF3hXmQaI1PDeoGH9d8pTNwBGeT3bhTUzqI+kgYf+0q0piZ27ZKz/SFXUPh9T Ek+U6PgCSATirJ93vBL271YAzmmPoMmYfYpNxjJsIU0mwm2wQxj1SlkkGWBRt3rTc513 UGDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672950; x=1794277750; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=EA63ABVwcLs3h/JxipVqiXIy94JHS7osXg+Mm97gaVg=; b=ca2SF2BBpq4Au02yo8rLLy0MLydrqn36dGEJ1mZKPZyfVplAvPODrQqfmZ8Ta4/A0v WHcg7h8OstkvDMKk2D0VaoOeArw/l/BpCA28mpCUjSyMVI4EUizTCDTXP1arQUpAQIFy vbriwknvbdfvYujDaaCllSjQlf+2rlyd047rVFw6BQ1pLR6ha0u2bDoIMbPii/Ouo9eZ lG3Gh2tSY4rorTYiybNruiOGI2dljo7dDhLH9vunXySMBfyF532/2gwt64g2Pl08p3kj diaVqirG9s8iLQkjKDu2zOrDy+8RuKvLSRSpifkSI1pcJMynE52Ptos3RMIlIbKAMT7Y ZPSA== X-Forwarded-Encrypted: i=1; AKwUvBw8cyjj6PPi9c5OX/cMBj7gzwRJRDupFyPTpzvO4JW7SPAGR4l1uy0QCN3h3n6/HKLx+B6UBEAiBuw=@lists.xenproject.org X-Gm-Message-State: AFq9FYK08HNARuzwB3/CawyLvzncKZQSnvuX69HnWMuHNhiLPQ7mLAyE EjN3VrNwJTPdjSqzVedUV8Z3R0eR6uJjUPD2Ce5dl6E+dX7wHP6CDyFX41MX0teWpeU= X-Gm-Gg: AYBFou3+KuJIv+MD5SHE+g9KhvR2kgxa46JbHg8/fTEnUOrhFsIUO7e+VgFoo7a82Hj Hj6THxf0X9ZgoiGSvCH+URWcQXJkmqzyULXJQJ684rUFUtUH8bGyIELkQCfUHA2L6zLsYIWAonR mZI/CRPiDK50nsBhs9MqZlZxLWVfAffmI5s32W1pLwqRGAQ2WUZAQ5bEIV5doIMRYSmknKd7dGT wJg1OdJN72vIayfllNuVAjeT9rEetMHWeC/vsg7jei+f9TkEIXjTWzovtVfLkbIBHfHuA3vhwD6 FS00U8QX5wlrnwszaxKEeuQRPbNjY/Ftac7a9NsIGMbal8klSJ3ssTd4w30Re7a9bnOSpKNdC04 Gq3/nqX+5JJOZhLxJlOaLqfdqX1ckxoeidgbzKpizHepC6Ckung57yvKKynI/oR1GG4830I5be4 JAS9zX7r6ceIYOtMMMnGUhQKzRT3id4qupitavSaj6EZbMtipQb6ImwH32KBv0O/j91zC16ZVpD 77WO3B88vo8GMPLBa+MDbPl5NHlJ3comYq5K7rUIHGu/IHalt4NoOznVgxrAJqlCNUPpnVKwhLe tCMWlEBeVWxlVNOXMa5/rrgZ2f5zyNhwGrQSgQ+pb/S5dA== X-Received: by 2002:a05:620a:17a9:b0:93e:5ff9:a8f4 with SMTP id af79cd13be357-9442135f4e4mr1720591185a.0.1793672950127; Mon, 02 Nov 2026 18:29:10 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:39 +0000 Subject: [PATCH net-next v3 13/15] xen-netfront: don't BUG() when skb_copy_bits() fails in bounce_skb() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-13-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672923; l=1213; i=josef@toxicpanda.com; h=from:subject:message-id; bh=m7OgokcwaZHLGjQXMpKbgpowrvI9FQDluMyHz8mi3Ig=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QG6bjet0JqDvVFJtGL5dr8aWS2Y1CrqqPkeXYvW304JvA/+zhQI48mUWQjXqe9iWtZ3dd/1Xbtp dxeEcxZi/5gk= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-33051d/1793672951-6DCD34E9-DF4CE17C/0/0 X-purgate-type: clean X-purgate-size: 1215 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672986203158500 bounce_skb() is an open-coded skb_copy() into a page-aligned buffer, and it has the same BUG_ON(skb_copy_bits()). skb_copy_bits() fails when the skb's lengths don't add up or its frags are unreadable. bounce_skb() already frees the new skb and returns NULL when the allocation comes back misaligned, and xennet_start_xmit() drops the packet in that case. Take the same path, with a DEBUG_NET_WARN_ON_ONCE() for debug kernels. Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the Reviewed-by: Juergen Gross --- drivers/net/xen-netfront.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index fdcb91042f29..17811d81937c 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -695,7 +695,12 @@ static struct sk_buff *bounce_skb(const struct sk_buff= *skb) /* Set the tail pointer and length */ skb_put(n, skb->len); =20 - BUG_ON(skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len)); + if (unlikely(skb_copy_bits(skb, -headerlen, n->head, + headerlen + skb->len))) { + DEBUG_NET_WARN_ON_ONCE(1); + kfree_skb(n); + return NULL; + } =20 skb_copy_header(n, skb); return n; --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672970; cv=none; d=zohomail.com; s=zohoarc; b=LMvFHw39OtmwcfocMLG0HAUxLk2dcY+dbdU3pmufkyuA9tsPBFjtPnRXiepVWmByF19xovUMOKupXobnHdSmsvYvfwXrqqoqeAvZMWfQtCptzeKgm2F22SY2gYD6ztq8a/xtFeDmiUrNSSYxEjbmXo8g4BnDVW2Igp+6mnLlorQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672970; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=vm4X83cKQV2cViXLrBy8CdaLxj8kNgfl4SZFvLru4UA=; b=E/JkNPMcTvsvGYKpKP8QES2kmHTWjOSOdpClcHmcIiCZJcK4nly+6++0pb6GyxohNmLXCCSX2E93i2NmeiDKVrLzQq5tw7ovPp4Z7jakhceaPrAero91Dr7TYKMcUpbtuKOU1bBabOIGGIKbOIRmCJgs15jdrGBFNBvm6S18t0E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672970554113.7745760326685; Mon, 2 Nov 2026 18:29:30 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468959.1678040 (Exim 4.92) (envelope-from ) id 1xO4Gy-00028C-6F; Tue, 03 Nov 2026 02:29:16 +0000 Received: by outflank-mailman (output) from mailman id 1468959.1678040; Tue, 03 Nov 2026 02:29:16 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gx-00026f-OH; Tue, 03 Nov 2026 02:29:15 +0000 Received: by outflank-mailman (input) for mailman id 1468959; Tue, 03 Nov 2026 02:29:14 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gw-0001qW-Et for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:29:14 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gv-00143l-Rl for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:29:13 +0100 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae946b5-2eae-0a2a0a5409dd-0a2a4501bef4-30 for ; Tue, 03 Nov 2026 03:29:13 +0100 Received: from [209.85.219.43] (helo=mail-qv1-f43.google.com) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946f8-5984-0a2a45010019-d155db2bb904-3 for ; Tue, 03 Nov 2026 03:29:13 +0100 Received: by mail-qv1-f43.google.com with SMTP id 6a1803df08f44-91c79f306e9so41141136d6.3 for ; Mon, 02 Nov 2026 18:29:13 -0800 (PST) Received: from toxicpanda.com ([153.61.196.255]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91ca7f401f5sm106359816d6.19.2026.11.02.18.29.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:29:11 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672952; x=1794277752; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vm4X83cKQV2cViXLrBy8CdaLxj8kNgfl4SZFvLru4UA=; b=byYtmngdSHP4ERa+/tfXK5vZV37Xudj+GQchWX57ogK26kh0qi7/Wu+9RHqHP6Lb0O PBFymtQ5BB2HJ7SFeZxaunXVvZtNDJshI62HOdCbW3WjnahAPMS5ocCDPl4nhLxWcFcC e1bF/9PWFB92TdqAo0zPsp0w8lg94sosXGJRTS/AdapQiwU6r1z0hBFuNb8LTi3i0Vt/ CrEGg1BMwT0+65nbMSKR5bC6T5vOyDyHbpVd9/O4UlyWiANwhWuY3vkV2y9l1LENm6QI Ur+/ldYCWQKNHR847FyUeeUVuJDAX2Bnt55Bp+MyQ6+4jJGrY5mbXgIc0LIlx7A8shC0 5wEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672952; x=1794277752; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=vm4X83cKQV2cViXLrBy8CdaLxj8kNgfl4SZFvLru4UA=; b=HIp1vatXI0tbHmLcFI41rvGNFpx7+oGSGQFNeAWFa57qBUQKJoo8/8+ideE6eWU2MK Np1zWL6pnsyurr4aSFSlv4thY0jJSOq3mMEeXOvXjsU7/mFo/dBu5YvSHuqB8RoBTslI ClwrV8oBDyY6KUwMCnqEiZhnaH9e9PiVi3HLmJTLD5xSgGtaU52SjcX/kRsC985mlWTh c/mGDfpaFKcJDR+ClrCntv4567cXSBAcMMnEVZgD58wwBtxBwcDlk2lL69XcGBkW32cy qE1VHTen9xk49eZjyLmD73vB190HKfWLx3R+6GUz+2ap599G8HZdpMLlWHQbUSuuWHtC HrWQ== X-Forwarded-Encrypted: i=1; AKwUvByeqbe9VTxdnWTlPdh7qIHB4Ez2tSKiXtXFTZZ2zNUQw9jIMatMv9N6NT7kXHMm6njkCjz4K7cfKHE=@lists.xenproject.org X-Gm-Message-State: APuU4Z9nOXTqaNGfFL+1oTAyZFkGGR7nA3YetgQdr2j9ztsnLPA6u2Jf zFlBqbM0Z4u1DRdXUQjGUw5Q2GdsM2CDQqCBuPHNMfCMTRJcfSDItrxN6pZzRCs0t6U= X-Gm-Gg: AYBFou2ekOSNhJmYHXAI/Gm18cbWkGak+wFGLNr5HUApxfu5pwU1cYN6+4It5Lv+NjF EBQatHsMah+GEtHL1hFSp/EXH9uhe3LW4KDvHZexQkKrDXbJ6kVBTVladZf+ff0dFMZk1bSvAWE zGN2y4E1I5FxYGsBOjeP1j8k4EGsMQMM6Kq9ciAZZAhfFs9Vom1uEGgVecGB8xQvWGIZas3ePlt RYZcDkTXzlLTRB4A0ghPrj4rcuJKzuRJAK7YXqwYPppjtgovAPFISY05tW9qhbxsq9SK31bSn7J Nw3fcUdsqp3nJVJh7gbYwf+uiutI33SBiwwDk9hOd6WQNspiiHfFPtKcu19+ZCp5svQTfkuOv+3 w9NgkHJC/OZsMvSlttwJjg4RideHBKZguQJTQ6V6s1nZ30wnpbqhcrUyTqQKPc+FDSFNFruXcY8 NTLZGwKZiz+kzallBOXLk+NDWrj9JCYi1VQm9ETOv8ZntBth4ukEUrzSyzgXXjfPeYSDBldGJPr yi4wVDB84PLxh0ZvjSbQfr6sVh4iLcILKCie2IhaV+L18ArRxgwfjmW0BHwPVlxJ9MFXE7CE9zD L+5tcnL62NSjvbk5qq0Fk4ZxEh5SoHlYHI5sRkSwO7bBFw== X-Received: by 2002:a05:6214:8588:10b0:91d:35ff:cb53 with SMTP id 6a1803df08f44-91d35ffcdc9mr8100016d6.37.1793672952196; Mon, 02 Nov 2026 18:29:12 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:40 +0000 Subject: [PATCH net-next v3 14/15] net/tls: don't BUG() on leftover length in __skb_nsg() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-14-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672923; l=1573; i=josef@toxicpanda.com; h=from:subject:message-id; bh=jtewRftckK13p/nQalxWcrhfGpFqhqstsSARsz5AoHI=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QKU+bYXkf9YXXl1oclL2Gvz2UVI2gtqcPepXaQA2KpnhXr1hun6qZ+lqT2IAQi6KyF0liU25rYL 0WlL33F1eag4= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d62444/1793672953-BE27A757-43DFE221/0/0 X-purgate-type: clean X-purgate-size: 1575 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672971917158500 __skb_nsg() counts the scatterlist entries for a range of an skb with a copy of the __skb_to_sgvec() walk, including its BUG_ON(len) when the skb runs out before the range does. tls_decrypt_sg() calls it on the same range it then passes to skb_to_sgvec(), so a bad range would BUG() here before it got to skb_to_sgvec()'s error return. __skb_nsg() already returns -EMSGSIZE for a frag_list nested too deep, and tls_decrypt_sg() fails the record on any return below 1. Return -EINVAL for the leftover length too, with a DEBUG_NET_WARN_ON_ONCE() for debug kernels, and say so in the comment above skb_nsg(). Acked-by: Mina Almasry Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/tls/tls_sw.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 771e02bff519..748ae27f2b88 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -142,12 +142,16 @@ static int __skb_nsg(struct sk_buff *skb, int offset,= int len, start =3D end; } } - BUG_ON(len); + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } return elt; } =20 /* Return the number of scatterlist elements required to completely map the - * skb, or -EMSGSIZE if the recursion depth is exceeded. + * skb, -EMSGSIZE if the recursion depth is exceeded, or -EINVAL if the skb + * runs out before @len does. */ static int skb_nsg(struct sk_buff *skb, int offset, int len) { --=20 2.55.0 From nobody Thu Nov 5 07:36:18 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793672984; cv=none; d=zohomail.com; s=zohoarc; b=kaWXHiYoJMdGj3ru4eDEq+ds6t6gR5XUi82NFLlR3hoZxTJJ4qdEhmopvIxzIdSYs3WwBwd0/76qwplQ2waFayU3WI8a8POxGB7bEeGEtoGCm/paLLo5drWRFMUaytWMGfW4mWI6bMxHslOh+1OTgamIuDfuPxeVI0EJMiwxCnU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793672984; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=a+hFTEOFR15xhICqJoC3sInecNo3QCMXYhk+gm+DR0k=; b=gsKKcvKyvYuUbq6TULZvk2rCC2aLPW5GGYzkJ5GKW5vkrSufU6ykzvKn7amnKvNy/UdPCYOPic/C+13NLhuj03WKK6TuuWvxuYRfaH3csdUpQYpnPuTIZIvLGYhnK5wyEkfqwaXpx4L9AtYZh4MTzDOFEiKRehIsEQigY0tNa6c= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793672983955756.1146489473667; Mon, 2 Nov 2026 18:29:43 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1468964.1678048 (Exim 4.92) (envelope-from ) id 1xO4H1-0002lM-Ok; Tue, 03 Nov 2026 02:29:19 +0000 Received: by outflank-mailman (output) from mailman id 1468964.1678048; Tue, 03 Nov 2026 02:29:19 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4H1-0002hq-3b; Tue, 03 Nov 2026 02:29:19 +0000 Received: by outflank-mailman (input) for mailman id 1468964; Tue, 03 Nov 2026 02:29:17 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xO4Gy-0002CX-LA for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 02:29:16 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xO4Gy-006j9s-0q for xen-devel@lists.xenproject.org; Tue, 03 Nov 2026 03:29:16 +0100 Received: from [10.42.69.10] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6ae946b4-8faa-0a2a0a5109dd-0a2a450ae7b2-28 for ; Tue, 03 Nov 2026 03:29:16 +0100 Received: from [209.85.160.180] (helo=mail-qt1-f180.google.com) by tlsNG-4011c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6ae946fb-f2d2-0a2a450a0019-d155a0b4c0b7-3 for ; Tue, 03 Nov 2026 03:29:15 +0100 Received: by mail-qt1-f180.google.com with SMTP id d75a77b69052e-53fdd2fb171so46767341cf.2 for ; Mon, 02 Nov 2026 18:29:15 -0800 (PST) Received: from toxicpanda.com ([153.61.196.255]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-5498ba831ecsm13704131cf.12.2026.11.02.18.29.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Nov 2026 18:29:13 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793672954; x=1794277754; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=a+hFTEOFR15xhICqJoC3sInecNo3QCMXYhk+gm+DR0k=; b=L97DqqtFzFpd6Lw32fn5xadqBpnOVYKjEyzLesDEcxL9LAS1pvt22Ki1NzKgPp6GvO aXm0ex/sklNLRtDnbStVKsUlZ9sy/9580iTB8uN8HIj0xaH9Gx8rrYUiw7jBetBlwhHY YdOtzNb/iqsrgtkXhhQj+QUtsJ5JHaKhSCwX+JNX6jvfUUqT3pNnZyHKjjWeR57xElUE PvQBPdBV7FBQwda+MmvAHMbTeE3Ew66eKU3dW42TehMnzdeh67GlHo2fpe+Grb8jgniH rnf5quB5CHOXvC+zGrjUgT5nTu5BIPm6NA1VfvrUevHj20RLJOdeFqvh16kyquDMsBO/ EncQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793672954; x=1794277754; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=a+hFTEOFR15xhICqJoC3sInecNo3QCMXYhk+gm+DR0k=; b=Vb5Bx9tCCRS7JmWnmYQZa8TVuSDtm9tOdGTv9F6Mq3rkRJ5anZuz9HFqDwDcbHIfbW 4ZXt+zocauLhtsKZ6xKa95zrKRyC8cKDidnauldVvncNSHiaOmKQRpLE+6wN677mUKa/ eXlLGUzBV/ae5cadne0z5tWojCG8D5JxjG40foa2r1n4lfEJlYM+D0TGNZ/3fTnE2K4O 5DAVgKfF4b38/68NGMmCjPJC5wWGJrRYG/bLdFx82p/vi+ZgqI0Z897354ppNceJHod1 KKijzKmoWuBq2Cb/OAH/CgLdwZLIdtG9wMmIJb/CIKoaFOkmA7LEWEU7cpmUxsYVPMyl DHww== X-Forwarded-Encrypted: i=1; AKwUvBzf+DZbXXLl187ex1cfu/tjCebHfc4T5eGvkX0baKtc5a9adSml2yQeWTHD5xR91Tjp/+hQGI5EqSw=@lists.xenproject.org X-Gm-Message-State: AFq9FYJ0jS1rQnf9tNOvzLKvdEJRNDfxlL0D8dCVkwhlfi9a9UhO+RCm YJ6NcZsp3rnWmCb+GvCjBXBtmCoLV6manHtwHnu/8wbgsM7mXbr/kcb0qrttnLxTE18= X-Gm-Gg: AYBFou0zUazy+WgsZUlHcYmTx5Xxk+KF9oAAYFfnAokGYmczhWGt2nm2YyVakLLDj6I H0FYgdxqaDtXvTOrd+5UJD7eWSQrWuGB5+oLjEnbGy7qy37neimkLt+uBIfrB0QoAKwDMZLLZ1C o07ly2YUBMPZeKTiVtIyNNEFSoTECzyjp5rP1jU4YoK4S7pXFb2ZQOIbWs2une6YBcRFA/T1h3A 44/+DvZtsOgo3A9HCb+fQi9DCiiAPRSUHL1TI1dU8jtzW6aaowWk6umlqdLDDVmivSlsYUGZ4Zu 2m3cILzExoBdgtSMBkvBA+qMx4Qn5lwzWJWInmyXcDS1BifS1ApdO+P7ab84oOXHHm0luVmL6Km FPRSy/IDT2+YaBuBdsVjoBqT55UGOxLyrCzK8nrnVvNOARa1ATS1rxaWNJmQ9cyUfqi/2hpaKMK iDxNuREIrf9YPfEvo9IO2JRZGy46uk969I0MQdtwv7JSQzYsuWLv7fxDpIW0FPRa7aoH3ozfBCp awGezNZh6eQ6cDxmfSSE40X4avtbwY++QpBt0KSO1BwBYouiaXdhz5gNJeYbuzaxpstkp0Boygl 6udUMOcjv2s2bJXdOKYOwfHp+0NWkeoxcs6yIalMimeEXQ== X-Received: by 2002:ac8:5a84:0:b0:53e:35dc:9bd7 with SMTP id d75a77b69052e-542b7cfff77mr195623591cf.61.1793672954512; Mon, 02 Nov 2026 18:29:14 -0800 (PST) From: Josef Bacik Date: Tue, 03 Nov 2026 02:28:41 +0000 Subject: [PATCH net-next v3 15/15] net: update comments that still describe the skb BUG_ON()s MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261103-b4-skbuff-bug-on-followups-v3-15-54ad0ab57614@toxicpanda.com> References: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> In-Reply-To: <20261103-b4-skbuff-bug-on-followups-v3-0-54ad0ab57614@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793672923; l=2967; i=josef@toxicpanda.com; h=from:subject:message-id; bh=WCTT9uC4bs2258XiDJAzFc52TKyNHZGhkrwOY27WXg4=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QE8kdpAIr4r/3KnRyoQejERf3bZuv462xd61M/4SF+RLGK/b0ul1CKeaOQhtpoJOgJfKTHf9Nhb J8aQzKvI8igI= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-4011c0/1793672955-53CD3CFC-0538624C/0/0 X-purgate-type: clean X-purgate-size: 2969 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793672986225158500 The skbuff BUG_ON() conversions left a few comments behind: - bpf_skb_net_grow() says skb_segment() BUG()s on a frag_list with head_frag set at the downgraded MSS. It fails the segmentation and the packet is dropped, which is still why the skb gets linearized. - The skb_to_sgvec() kernel-doc doesn't list the -EINVAL that __skb_to_sgvec() returns when @offset and @len run past the end of the skb. - A comment in the netmem KUnit test names BUG_ON(i >=3D nfrags) in skb_segment(), which is a check that fails the segmentation now. No functional change. Acked-by: Mina Almasry Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/filter.c | 6 +++--- net/core/net_test.c | 2 +- net/core/skbuff.c | 5 +++-- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 09c60a58c82a..9881ac89e94c 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -3723,9 +3723,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 = off, u32 len_diff, shinfo->gso_segs =3D 0; =20 /* Due to header growth, MSS needs to be downgraded. - * There is a BUG_ON() when segmenting the frag_list with - * head_frag true, so linearize the skb after downgrading - * the MSS. + * Segmenting a frag_list with head_frag true at the new MSS + * fails and the packet gets dropped, so linearize the skb + * after downgrading the MSS. */ if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) { skb_decrease_gso_size(shinfo, len_diff); diff --git a/net/core/net_test.c b/net/core/net_test.c index 298ca240104c..7bfafc826b14 100644 --- a/net/core/net_test.c +++ b/net/core/net_test.c @@ -1466,7 +1466,7 @@ static void netmem_ref_test_skb_segment(struct kunit = *test) /* 5. Linear head_skb (nr_frags=3D0) + mixed pp_recycle frag_list where * member A has linear + frag (pp_recycle=3D1) and tail member B has * linear len =3D=3D skb_headlen(A) (pp_recycle=3D0): keeps SG clone path - * synchronized without hitting BUG_ON(i >=3D nfrags). + * synchronized without failing the i >=3D nfrags check. */ head =3D alloc_skb(64, GFP_KERNEL); list =3D alloc_skb(64, GFP_KERNEL); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index b2c44a58db23..bca69e8b3582 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5639,8 +5639,9 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlis= t *sg, int offset, int len, * * Fill the specified scatter-gather list with mappings/pointers into a * region of the buffer space attached to a socket buffer. Returns either - * the number of scatterlist items used, or -EMSGSIZE if the contents - * could not fit. + * the number of scatterlist items used, -EMSGSIZE if the contents + * could not fit, or -EINVAL if @offset and @len run past the end of + * the skb. */ int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, = int len) { --=20 2.55.0