From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825295; cv=none; d=zohomail.com; s=zohoarc; b=YNmUX+PQ78EqHvLhq+fnWSk2kJNaEl3jUm75SFxo+RW7WLefw6MMoXymYyDTfnPwR7fWUo327eta5T+cH3vbbv3lWTS/iJ5omqmfNAP6XaNjtzG21EStyE28acxQoSWPW88kpsJYH4cuqc+nGO6iSV2b98FlBZOOHu9gXRhJcgo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825295; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=gH271GlUICfDLFVrS64JI/r5nC3Lsa5y8Cpm0L9A1DU=; b=JvaGO1svLhweB5NajpmVazhuA0hU7q63RylosBnMSrRgJqvFTGvXGaxqlVLDAJYLtFQOQQt2E4AHXAFOa2SuvZtz9+wNs5HeqIfttXOr+MEEyuKNvxl/r9X0ut+kSlyxyhDPV1ByTgvrKnpJBc/90X78vbZQzTc15Mjb2BoRhAg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825295484453.08647987271524; Wed, 4 Nov 2026 12:48:15 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472756.1680581 (Exim 4.92) (envelope-from ) id 1xOhtj-0002fk-U2; Wed, 04 Nov 2026 20:47:55 +0000 Received: by outflank-mailman (output) from mailman id 1472756.1680581; Wed, 04 Nov 2026 20:47:55 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtj-0002fW-QK; Wed, 04 Nov 2026 20:47:55 +0000 Received: by outflank-mailman (input) for mailman id 1472756; Wed, 04 Nov 2026 20:47:54 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhti-0002bo-2g for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:47:54 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhth-00FYWL-Fr for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:47:53 +0100 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99e8-bab6-0a2a0a5309dd-0a2a450c9a30-18 for ; Wed, 04 Nov 2026 21:47:53 +0100 Received: from [209.85.219.52] (helo=mail-qv1-f52.google.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb99f8-f479-0a2a450c0019-d155db34aca4-3 for ; Wed, 04 Nov 2026 21:47:53 +0100 Received: by mail-qv1-f52.google.com with SMTP id 6a1803df08f44-91c76540d0bso12576946d6.0 for ; Wed, 04 Nov 2026 12:47:53 -0800 (PST) Received: from toxicpanda.com ([153.61.196.255]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91e8dac2a3esm13006576d6.1.2026.11.04.12.47.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:47:51 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825272; x=1794430072; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=gH271GlUICfDLFVrS64JI/r5nC3Lsa5y8Cpm0L9A1DU=; b=V5xN3MfyqbiSFu/dJDdo1wtIzbUIpfHKmj4mfgS3QM4exmmZUIEMV/kbpSFNMKMRuX iMkfdPpQwnhUtGeoB+YzBz9aCAp6t/S8xv+0n8LMvYoixpW8EyQ7A/QAF6kE1MfSXzIy aKCjnO+QniVQL8TTKnHyZ/MRT0gxtJ932lb6h974pN9Q+J2WJo56+IZlWGsQkCqWQZSP XNOFkfA7RuPrwOgbRnbLNgt5vQol9iv9Kt5uXJfbUbOlcGZneRXLQrZeF+Mj9VIYtpij spDsDv4UdEEa+9fnhto9Wxg6Wyn47dpyFMQYtfFRsRKDEZEa/w8HJSq5sHndehguLgpC OOmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825272; x=1794430072; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=gH271GlUICfDLFVrS64JI/r5nC3Lsa5y8Cpm0L9A1DU=; b=Lj7Ze0nLbBEs2kmo0jK7zuUhKWXabiOuJ1lx9Vvxf0TKNgo9Gi/s/mwvvkQlCww8rL /Rbjaisz4Yi4kyvqoojmr6Bd/zVtCCz5s1kS0XtX/Y0QiwEjogm4X92CRcOx8R0/wAh0 lJAH+i3S+h7qL00N/PpkCpKfpZ6wPPuAhX/nVcF/tpAnT67nOiHgSnpisc1n0ailfE9k e2likeOqIjB5VI6fKprJarsAESvP8lcDIiv0SNH/QTYqLwbabAeh6rsBq5ZFqc4nGLku 14taHmR1SvL1OHVJfnfeKFIbRD/Nk7Rr/TQeV2lbCWZMggoNRT3NiZcnBmxEkL3HnEWz S7Rw== X-Forwarded-Encrypted: i=1; AKwUvBwZlr/bm5HEIJCLLAWhye6R9OrSbv9VghzehrlPt6tySX58EIB5D+hWXMQlyO21abdh9lcvueuRzpQ=@lists.xenproject.org X-Gm-Message-State: APuU4Z87Vk4s/T4AB3RR7wb3i/xazhP3qUQg3ydrR6gCqGV+AeTKQHI3 GSQPuffQXvEhe3po32d7tfaSndsr9FHpd2u2sA/2u/hb1ziaGtOmZoTWQHr7dYAzjhk= X-Gm-Gg: AYBFou2zxoGL4Im4F4cbC08kZw3C9hP+/FcPCFiv5Eplx91MF5++bCOUk4/YhIRprcX QscDX85M2zIXYF/0mZK0PFsfnPvcP2aVlSO5n/XrGqm2QEiwHdtDbWxy/vSLnnDw1CztB0qq2nw bBBB2Kl2i1uEMZHc5bxBi1oKVMtf3X1cUN4HS+h3nbe5ZFjlXa/EwNxgW1DhCXGkg5O1FcmE75M OITFh4Rlle0jESy30umLWET1DDngJBqHdvUqZLU2Z/pqYT5Rnion4Y6PtFSdfbMkdXlujDyJwBp oLCLAeZBW3kNgNynXo5lab2i0tbZxW9leCFyJHRxW9XinKCqMqjjOuR/8FfQz92K7saEwpR4mox hMOJ8HBpa8uVai/AEjCAm/28hVF84wP19gCQ4sdBrLSyThC/u09qWzSA21Ohc9faMGI/mrktAIn 4KJwHzbQS0bpJzvgRJpV2phrwncNb0zHJfMWWz9B/9peHaylgzL0EZeDypAqFA5UdPKR3FqcqfQ 6MaxpzMyaYXdML80Md5uv/udk12cKEkX8iTrUUlRaG8NqLUJxsChbR5L81eEL7vtsKLhsvRHZXT XfGTozwS//7I+sntZVIMa51FCXZjBAoukSncsWhug2/+11o+Xs2zw9vkelLc9njqchtn X-Received: by 2002:a05:6214:5bc5:b0:91c:7da5:2185 with SMTP id 6a1803df08f44-91ca4bb4a15mr307849916d6.38.1793825271664; Wed, 04 Nov 2026 12:47:51 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:13 +0000 Subject: [PATCH net-next v4 01/15] net: skbuff: make skb_copy_and_csum_bits() report unreadable frags MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-1-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825268; l=13813; i=josef@toxicpanda.com; h=from:subject:message-id; bh=EWpLlq8Mw3XxwjVP1ClwIfXj7doLlC4zD1PirZnOhYE=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QJqO/KYWLso78B3NTCNEG4Z4lztm1S6ZIMPwryAlJHaZV5533DWzIbtoHA2wJ0OEbED8w0X7uPN RS3fTmef4xAo= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d25034/1793825273-5093EA5B-E2411D77/0/0 X-purgate-type: clean X-purgate-size: 13815 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825296908158500 skb_copy_and_csum_bits() has no way to fail. When it reaches unreadable frags, or runs out of skb before @len, it zero-fills the rest of the buffer and returns 0. Its callers can't tell that the copy didn't happen. In the !sg && !csum branch of skb_segment() that turns a devmem TCP payload into zeroes under a valid TCP checksum, and the peer accepts them as stream data. It takes a device with both SG and TX checksum offload turned off. A test module that segments an skb with 3000 bytes in an unreadable frag gets 3 all-zero segments before this patch and -EFAULT after it. Return 0 or -EFAULT, hand the checksum back through a pointer, and mark the function __must_check. Every caller takes the error path it already has for a failed copy. skb_copy_and_csum_dev() can't return an error, so it zeroes the whole frame. csum_partial_copy_to_xdr() no longer checksums the bytes it didn't copy. That only ran when the function was about to fail anyway, and skb_checksum() warns on an unreadable skb. The !sg && csum branch of skb_segment() copies with skb_copy_bits() and returns -ENOMEM when that fails. Make it -EFAULT as well, so that both branches report the same failure the same way. The frag_list loop takes the address of a local, so it moves into a noinline function to keep a stack protector out of skb_copy_and_csum_bits(). Found by the Sashiko AI review of commit ab9414ed70bd ("net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()"). Fixes: ab9414ed70bd ("net: skbuff: don't leave stale bytes in skb_copy_and_= csum_bits()") Fixes: 417261779eab ("net: skbuff: don't BUG() on leftover length in skb_co= py_and_csum_bits()") Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Link: https://lore.kernel.org/all/179148235783.434549.14322374227477832817@= kernel.org/ Suggested-by: Mina Almasry Reviewed-by: Mina Almasry Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- drivers/net/ethernet/sun/sunvnet_common.c | 10 ++- include/linux/skbuff.h | 4 +- net/core/skbuff.c | 137 ++++++++++++++++++++------= ---- net/ipv4/icmp.c | 9 +- net/ipv4/ip_output.c | 11 ++- net/ipv6/icmp.c | 7 +- net/ipv6/ip6_output.c | 11 ++- net/sunrpc/socklib.c | 9 +- 8 files changed, 130 insertions(+), 68 deletions(-) diff --git a/drivers/net/ethernet/sun/sunvnet_common.c b/drivers/net/ethern= et/sun/sunvnet_common.c index 5cca95869052..4f229fcecc32 100644 --- a/drivers/net/ethernet/sun/sunvnet_common.c +++ b/drivers/net/ethernet/sun/sunvnet_common.c @@ -1167,9 +1167,13 @@ static inline struct sk_buff *vnet_skb_shape(struct = sk_buff *skb, int ncookies) =20 /* copy the rest, with csum calculation */ *(__sum16 *)(skb->data + offset) =3D 0; - csum =3D skb_copy_and_csum_bits(skb, start, - nskb->data + start, - skb->len - start); + if (skb_copy_and_csum_bits(skb, start, + nskb->data + start, + skb->len - start, &csum)) { + dev_kfree_skb(nskb); + dev_kfree_skb(skb); + return NULL; + } =20 /* add in the header checksums */ if (skb->protocol =3D=3D htons(ETH_P_IP)) { diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 6787fcf6ac3e..f4c092b78006 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4280,8 +4280,8 @@ void skb_free_datagram(struct sock *sk, struct sk_buf= f *skb); int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int f= lags); int skb_copy_bits(const struct sk_buff *skb, int offset, void *to, int len= ); int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int = len); -__wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset, u8 *t= o, - int len); +int __must_check skb_copy_and_csum_bits(const struct sk_buff *skb, int off= set, + u8 *to, int len, __wsum *csump); int skb_splice_bits(struct sk_buff *skb, struct sock *sk, unsigned int off= set, struct pipe_inode_info *pipe, unsigned int len, unsigned int flags); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 48f676411724..f52b0717e4da 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3620,14 +3620,74 @@ __wsum skb_checksum(const struct sk_buff *skb, int = offset, int len, __wsum csum) } EXPORT_SYMBOL(skb_checksum); =20 -/* Both of above in one bottle. */ +/* The frag_list part of skb_copy_and_csum_bits(). It's out of line so th= at + * taking the address of csum2 doesn't cost every caller a stack protector. + */ +static noinline int skb_copy_and_csum_frag_list(const struct sk_buff *skb, + int start, int offset, u8 *to, + int len, int pos, __wsum csum, + __wsum *csump) +{ + struct sk_buff *frag_iter; + int copy, err; + + skb_walk_frags(skb, frag_iter) { + __wsum csum2; + int end; + + WARN_ON(start > offset + len); + + end =3D start + frag_iter->len; + copy =3D end - offset; + if (copy > 0) { + if (copy > len) + copy =3D len; + err =3D skb_copy_and_csum_bits(frag_iter, offset - start, + to, copy, &csum2); + if (err) { + /* The child zeroed its part; zero the rest. */ + memset(to + copy, 0, len - copy); + return err; + } + csum =3D csum_block_add(csum, csum2, pos); + len -=3D copy; + if (len =3D=3D 0) + goto out; + offset +=3D copy; + to +=3D copy; + pos +=3D copy; + } + start =3D end; + } + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + /* Don't hand the caller a buffer with stale bytes in it. */ + if (len > 0) + memset(to, 0, len); + return -EFAULT; + } +out: + *csump =3D csum; + return 0; +} =20 -__wsum skb_copy_and_csum_bits(const struct sk_buff *skb, int offset, - u8 *to, int len) +/** + * skb_copy_and_csum_bits - copy data out of an skb and checksum it + * @skb: source buffer + * @offset: offset in @skb to start copying from + * @to: destination buffer + * @len: number of bytes to copy + * @csump: where to store the checksum of the copied bytes + * + * Return: 0 on success, or -EFAULT if @skb has unreadable frags or runs + * out before @len does. On failure *@csump is not set and the part of + * @to that couldn't be filled is zeroed. + */ +int skb_copy_and_csum_bits(const struct sk_buff *skb, int offset, + u8 *to, int len, __wsum *csump) { int start =3D skb_headlen(skb); int i, copy =3D start - offset; - struct sk_buff *frag_iter; int pos =3D 0; __wsum csum =3D 0; =20 @@ -3638,7 +3698,7 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *s= kb, int offset, csum =3D csum_partial_copy_nocheck(skb->data + offset, to, copy); if ((len -=3D copy) =3D=3D 0) - return csum; + goto out; offset +=3D copy; to +=3D copy; pos =3D copy; @@ -3648,7 +3708,7 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff *s= kb, int offset, /* Don't hand the caller a buffer with stale bytes in it. */ if (len > 0) memset(to, 0, len); - return 0; + return -EFAULT; } =20 for (i =3D 0; i < skb_shinfo(skb)->nr_frags; i++) { @@ -3680,43 +3740,18 @@ __wsum skb_copy_and_csum_bits(const struct sk_buff = *skb, int offset, } =20 if (!(len -=3D copy)) - return csum; + goto out; offset +=3D copy; to +=3D copy; } start =3D end; } =20 - skb_walk_frags(skb, frag_iter) { - __wsum csum2; - int end; - - WARN_ON(start > offset + len); - - end =3D start + frag_iter->len; - if ((copy =3D end - offset) > 0) { - if (copy > len) - copy =3D len; - csum2 =3D skb_copy_and_csum_bits(frag_iter, - offset - start, - to, copy); - csum =3D csum_block_add(csum, csum2, pos); - if ((len -=3D copy) =3D=3D 0) - return csum; - offset +=3D copy; - to +=3D copy; - pos +=3D copy; - } - start =3D end; - } - if (unlikely(len)) { - DEBUG_NET_WARN_ON_ONCE(1); - /* Don't hand the caller a buffer with stale bytes in it. */ - if (len > 0) - memset(to, 0, len); - return 0; - } - return csum; + return skb_copy_and_csum_frag_list(skb, start, offset, to, len, pos, + csum, csump); +out: + *csump =3D csum; + return 0; } EXPORT_SYMBOL(skb_copy_and_csum_bits); =20 @@ -4001,9 +4036,15 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb= , u8 *to) skb_copy_from_linear_data(skb, to, csstart); =20 csum =3D 0; - if (csstart !=3D skb->len) - csum =3D skb_copy_and_csum_bits(skb, csstart, to + csstart, - skb->len - csstart); + if (csstart !=3D skb->len && + skb_copy_and_csum_bits(skb, csstart, to + csstart, + skb->len - csstart, &csum)) { + /* Send zeroes rather than intact headers on a payload that + * couldn't be copied. + */ + memset(to, 0, skb->len); + return; + } =20 if (skb->ip_summed =3D=3D CHECKSUM_PARTIAL) { long csstuff =3D csstart + skb->csum_offset; @@ -5057,16 +5098,20 @@ struct sk_buff *skb_segment(struct sk_buff *head_sk= b, if (!csum) { if (!nskb->remcsum_offload) nskb->ip_summed =3D CHECKSUM_NONE; - SKB_GSO_CB(nskb)->csum =3D - skb_copy_and_csum_bits(head_skb, offset, - skb_put(nskb, - len), - len); + if (skb_copy_and_csum_bits(head_skb, offset, + skb_put(nskb, len), + len, + &SKB_GSO_CB(nskb)->csum)) { + err =3D -EFAULT; + goto err; + } SKB_GSO_CB(nskb)->csum_start =3D skb_headroom(nskb) + doffset; } else { - if (skb_copy_bits(head_skb, offset, skb_put(nskb, len), len)) + if (skb_copy_bits(head_skb, offset, skb_put(nskb, len), len)) { + err =3D -EFAULT; goto err; + } } continue; } diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c index 90c0e22c29be..35008785e3d2 100644 --- a/net/ipv4/icmp.c +++ b/net/ipv4/icmp.c @@ -364,12 +364,15 @@ static int icmp_glue_bits(void *from, char *to, int o= ffset, int len, int odd, DEFINE_RAW_FLEX(struct icmp_bxm, icmp_param, replyopts.opt.__data, IP_OPTIONS_DATA_FIXED_SIZE); __wsum csum; + int err; =20 icmp_param =3D from; =20 - csum =3D skb_copy_and_csum_bits(icmp_param->skb, - icmp_param->offset + offset, - to, len); + err =3D skb_copy_and_csum_bits(icmp_param->skb, + icmp_param->offset + offset, + to, len, &csum); + if (err) + return err; =20 skb->csum =3D csum_block_add(skb->csum, csum, odd); if (icmp_param->data.icmph.type <=3D NR_ICMP_TYPES && diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 3396f177a18d..f7da4538d05b 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1162,9 +1162,14 @@ static int __ip_append_data(struct sock *sk, data +=3D fragheaderlen + exthdrlen; =20 if (fraggap) { - skb->csum =3D skb_copy_and_csum_bits( - skb_prev, maxfraglen, - data + transhdrlen, fraggap); + if (skb_copy_and_csum_bits(skb_prev, maxfraglen, + data + transhdrlen, + fraggap, + &skb->csum)) { + err =3D -EFAULT; + kfree_skb(skb); + goto error; + } skb_prev->csum =3D csum_sub(skb_prev->csum, skb->csum); data +=3D fraggap; diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c index a95b0351824f..31ca3da80b1f 100644 --- a/net/ipv6/icmp.c +++ b/net/ipv6/icmp.c @@ -322,9 +322,12 @@ static int icmpv6_getfrag(void *from, char *to, int of= fset, int len, int odd, st struct icmpv6_msg *msg =3D (struct icmpv6_msg *) from; struct sk_buff *org_skb =3D msg->skb; __wsum csum; + int err; =20 - csum =3D skb_copy_and_csum_bits(org_skb, msg->offset + offset, - to, len); + err =3D skb_copy_and_csum_bits(org_skb, msg->offset + offset, + to, len, &csum); + if (err) + return err; skb->csum =3D csum_block_add(skb->csum, csum, odd); if (!(msg->type & ICMPV6_INFOMSG_MASK)) nf_ct_attach(skb, org_skb); diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 25fe0ba98b1a..d259e7dca8ba 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1724,9 +1724,14 @@ static int __ip6_append_data(struct sock *sk, skb->transport_header =3D (skb->network_header + fragheaderlen); if (fraggap) { - skb->csum =3D skb_copy_and_csum_bits( - skb_prev, maxfraglen, - data + transhdrlen, fraggap); + if (skb_copy_and_csum_bits(skb_prev, maxfraglen, + data + transhdrlen, + fraggap, + &skb->csum)) { + err =3D -EFAULT; + kfree_skb(skb); + goto error; + } skb_prev->csum =3D csum_sub(skb_prev->csum, skb->csum); data +=3D fraggap; diff --git a/net/sunrpc/socklib.c b/net/sunrpc/socklib.c index d8d8842c7de5..5d780ad4ae3a 100644 --- a/net/sunrpc/socklib.c +++ b/net/sunrpc/socklib.c @@ -49,7 +49,9 @@ xdr_skb_read_bits(struct xdr_skb_reader *desc, void *to, = size_t len) if (desc->need_checksum) { __wsum csum; =20 - csum =3D skb_copy_and_csum_bits(desc->skb, desc->offset, to, len); + if (unlikely(skb_copy_and_csum_bits(desc->skb, desc->offset, + to, len, &csum))) + return 0; desc->csum =3D csum_block_add(desc->csum, csum, desc->offset); } else { if (unlikely(skb_copy_bits(desc->skb, desc->offset, to, len))) @@ -142,11 +144,6 @@ int csum_partial_copy_to_xdr(struct xdr_buf *xdr, stru= ct sk_buff *skb) desc.csum =3D csum_partial(skb->data, desc.offset, skb->csum); if (xdr_partial_copy_from_skb(xdr, &desc) < 0) return -1; - if (desc.offset !=3D skb->len) { - __wsum csum2; - csum2 =3D skb_checksum(skb, desc.offset, skb->len - desc.offset, 0); - desc.csum =3D csum_block_add(desc.csum, csum2, desc.offset); - } if (desc.count) return -1; if (csum_fold(desc.csum)) --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825298; cv=none; d=zohomail.com; s=zohoarc; b=dyxGg5MriTUEwn/MJ86CrlCFK9bmxn0cmFB3F/FhN++qnu50Jmv2wvEsgS04K1lQDPIUmhwLKErgmBcYEWH97pTxjzhau3NJIDjVLvo62fFQZvMvycd7r+e97LW+AtG6nquZlo+tGB7Bcg9EYqBfjD9T4h+v2ivc2qw/pLl9s5k= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825298; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=4zFbC/7v49JIwDAMUqTjgaY3Ekh9T54PUOgPwA6tYbI=; b=fmsSQn6WhP4VACZSJU6Qup9QHl/10RAJ0e7Rqd/poYfYFw/d5iVwMinuvMp7jbiA0mIfCVmfUdr5Tj9iJKA4fRYZkA8H7QrZSoG0BN7t/3IPyFvZ8M3nnjQw5T1SMwT6nIPZjIQAdccBIy4MFaQnWcXMz1oialvm0miOIQA3IKw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825298785158.88562644450326; Wed, 4 Nov 2026 12:48:18 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472757.1680589 (Exim 4.92) (envelope-from ) id 1xOhtk-0002o2-DG; Wed, 04 Nov 2026 20:47:56 +0000 Received: by outflank-mailman (output) from mailman id 1472757.1680589; Wed, 04 Nov 2026 20:47:56 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtk-0002mE-7N; Wed, 04 Nov 2026 20:47:56 +0000 Received: by outflank-mailman (input) for mailman id 1472757; Wed, 04 Nov 2026 20:47:55 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtj-0002dA-5Y for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:47:55 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhti-00BcE3-Ib for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:47:54 +0100 Received: from [10.42.69.2] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99d6-e002-0a2a0a5209dd-0a2a450282b2-18 for ; Wed, 04 Nov 2026 21:47:54 +0100 Received: from [209.85.160.174] (helo=mail-qt1-f174.google.com) by tlsNG-720697.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb99f9-6ca4-0a2a45020019-d155a0aeb8b4-3 for ; Wed, 04 Nov 2026 21:47:54 +0100 Received: by mail-qt1-f174.google.com with SMTP id d75a77b69052e-53bb57f1310so11349381cf.2 for ; Wed, 04 Nov 2026 12:47:54 -0800 (PST) Received: from toxicpanda.com ([153.61.196.245]) by smtp.gmail.com with ESMTPSA id af79cd13be357-945d479a7easm292770685a.12.2026.11.04.12.47.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:47:52 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825273; x=1794430073; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4zFbC/7v49JIwDAMUqTjgaY3Ekh9T54PUOgPwA6tYbI=; b=QYt9t59govcQuK+XLBMfxW8hcGWMg3+2J1WuXzqUCLajk76yIyYrqWHYNBpbSbS0Ao x2ObypGFcmXdogA05L2IyGDqRRuT+0aFkJtUFdv+xwHAGhJSGqj4uXEl1JFOOCQ0eHV0 a5Y6ceUisMWrZnsqVHK7NgS9ea4Gy0/I8zBbZk9sTGaSup0cm1cDMQwR1IIBsQt2QUoy cQxB02VL7kx2W1XlzOwXM9AOUeyEl6ws8FG2beyBH160Vz479bCVR3bZcPiZgRXepYwp R6dYATBtPtNT/AJVj4XyQWz0tEiyD0ijZrAksIpobLz5PMP0aDAHJVoenVBmU3tdZMO4 S4Bg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825273; x=1794430073; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=4zFbC/7v49JIwDAMUqTjgaY3Ekh9T54PUOgPwA6tYbI=; b=rVz4joHoK8pHab9EKGdkNETCIcK+qRLWfZRpKOu69l1FKvPrcCM9Tl9mQqJZY7iki2 /TiZiD0MAmWNHQO3oQBRaqjvRF63m9M58hCXb8TtCR4r4nR4ov/FTZP4/eR9mkFxXA6Z yJDaktXs1A9PsOo/pr2gqitwekfa+n1IzKRe4GJzNTL9UK9tPqu1kZemlo+qhVKdywHq ZiRcFmqmWydx8g5Cm3QIEFqgV4Rp/og3IrLomyR80WRQyuHUIUOAHowXJupOdaxEe7cm Trsf8HudODwntRxPhaKJq2QhhvnLtumWrwoD6pSLRVtALPlQX5T9rEYMzJp0oNCXEIUd vDgg== X-Forwarded-Encrypted: i=1; AKwUvBxx3Tam0doHUZytqYCy+2O4QTFSlXosRz45cw85UyHt7638umPwsp5Y4hDfjHsLldR6qn/HYgvtiWY=@lists.xenproject.org X-Gm-Message-State: APuU4Z+9xUPiN527UkqA8phAwXLscksPi9IAYpq5FhqwXmayhISUUQZe eSPi8kiRCalNGRaEkZGpm3k01Xbwg2DIzM+qoS5Z157Jsw2IWbCdZ1h5yfna47ZADeg= X-Gm-Gg: AYBFou2+PUlYl45P3rYEL9vG6eE5yZmvgjrymdI78heJGid15SejRn/ee5+LBLNp1as 2EgoULJVV+iR9PnUbBo5xptBHtufasLdc9mg9RTyFpyKmi1Vulh0OljB0fjEySB7jjnlFSrre0Z n8h5tEu25JjFbgjAhUCJfYbcPPph8KPOElQLgdDFNXvD9GZS+g39dk0nkY8gCyUGAjhQkEnNasV TVSM+G4bXY5rFe/5rlutWQckS/piYHvOhHMuFWCd+u6nlu76DIE90yfVjrTe2wU3Cy8JVTAYyCh rE47TgK3GJ2UT9Gz5/K3ptlm3EDU5py6y39oRQO8ZQeWHR13QF9bVgpmW8nxioOuHz1yNE1BE/R KbMjN/3qo5uFV3J0/r0ByNRFCUNkNz6orDT6gyi6g3bmRb4ltX7A/MBINWeWktdYC1dt7SoQkci DcOTgv9D3x7pLtj4Itz+6GzUW44oXc7bgWMCsTcjVdsI8kUyuDEYlDA+T52dlk2ASCnGhQ7NXMF XguJpnJZon/k0hvBSxKKRtwlM9djaFYLuFgt40d8aMqLC2bL4ETeEc9pF+NE9wLfbtu17JNnb8V 8xZvfR2USWxyfm3e5qFA+IAAcDbUMzp9rUMMC7RiA37oAw== X-Received: by 2002:a05:620a:6485:b0:93e:94f2:ada5 with SMTP id af79cd13be357-94421659b6cmr2765029485a.25.1793825272920; Wed, 04 Nov 2026 12:47:52 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:14 +0000 Subject: [PATCH net-next v4 02/15] net: skbuff: add skb_checksum_full() that reports failure MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-2-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825268; l=7462; i=josef@toxicpanda.com; h=from:subject:message-id; bh=d2CsFLSStwR7TGVFC+ZiW187zIVn3/uYt4yIWAhReOw=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QBXORyJhU0rJllDflHqUJ2j1KtvdAJ3xu+S8gR8KsNKR8EZZffwb0bw4sZdXclvEZDEkJjiW8pD dMjfKjVkjGAQ= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-720697/1793825274-664B62AC-5279312C/0/0 X-purgate-type: clean X-purgate-size: 7464 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825300889158501 skb_checksum() can't fail. When the range runs into unreadable frags or past the end of the skb, skb_checksum() returns 0, which is also a valid checksum, so its callers can't tell a sum from a failure. Add skb_checksum_full(), which adds the range's sum to *@csump and returns 0. On failure it leaves *@csump alone and returns -EFAULT, or -EINVAL for a negative length. It is __must_check. Its frag_list loop sits in a noinline function so that taking the address of a local doesn't give skb_checksum_full() a stack protector. skb_checksum() becomes a wrapper for the callers that aren't converted yet, and still returns 0 on failure. Three things change for them: - When a frag_list member fails, skb_checksum() returns 0 for the whole range instead of the sum of the parts it could read. Neither value is the checksum of the range. - skb_checksum() only warns about unreadable frags if @skb itself has them. - A negative length returns 0 instead of reaching csum_partial(). Convert skb_checksum_help(), which can already return an error, so that a packet that can't be checksummed is dropped instead of sent with a wrong checksum. The following patches convert checksum validation, skb_segment() and pskb_trim_rcsum(). The rest will follow per subsystem. Fixes: 20ddd0fd2fcd ("net: skbuff: don't BUG() on leftover length in skb_ch= ecksum() and friends") Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- include/linux/skbuff.h | 2 + net/core/dev.c | 7 +++- net/core/skbuff.c | 111 ++++++++++++++++++++++++++++++++++++---------= ---- 3 files changed, 90 insertions(+), 30 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index f4c092b78006..608c1491597e 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4282,6 +4282,8 @@ int skb_copy_bits(const struct sk_buff *skb, int offs= et, void *to, int len); int skb_store_bits(struct sk_buff *skb, int offset, const void *from, int = len); int __must_check skb_copy_and_csum_bits(const struct sk_buff *skb, int off= set, u8 *to, int len, __wsum *csump); +int __must_check skb_checksum_full(const struct sk_buff *skb, int offset, + int len, __wsum *csump); int skb_splice_bits(struct sk_buff *skb, struct sock *sk, unsigned int off= set, struct pipe_inode_info *pipe, unsigned int len, unsigned int flags); diff --git a/net/core/dev.c b/net/core/dev.c index 3ac700d37e59..00a62c391056 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3665,7 +3665,7 @@ void skb_warn_bad_offload(const struct sk_buff *skb) */ int skb_checksum_help(struct sk_buff *skb) { - __wsum csum; + __wsum csum =3D 0; int ret =3D 0, offset; =20 if (skb->ip_summed =3D=3D CHECKSUM_COMPLETE) @@ -3697,13 +3697,16 @@ int skb_checksum_help(struct sk_buff *skb) offset, skb_headlen(skb)); goto out; } - csum =3D skb_checksum(skb, offset, skb->len - offset, 0); + ret =3D skb_checksum_full(skb, offset, skb->len - offset, &csum); + if (ret) + goto out; =20 offset +=3D skb->csum_offset; if (unlikely(offset + sizeof(__sum16) > skb_headlen(skb))) { DO_ONCE_LITE(skb_dump, KERN_ERR, skb, false); WARN_ONCE(true, "offset+2 (%zu) > skb_headlen() (%u)\n", offset + sizeof(__sum16), skb_headlen(skb)); + ret =3D -EINVAL; goto out; } ret =3D skb_ensure_writable(skb, offset + sizeof(__sum16)); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index f52b0717e4da..d51fdcb3e016 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3536,27 +3536,88 @@ int skb_store_bits(struct sk_buff *skb, int offset,= const void *from, int len) } EXPORT_SYMBOL(skb_store_bits); =20 -/* Checksum skb data. */ -__wsum skb_checksum(const struct sk_buff *skb, int offset, int len, __wsum= csum) +/* The frag_list part of skb_checksum_full(). It's out of line so that ta= king + * the address of csum2 doesn't cost every caller a stack protector. + */ +static noinline int skb_checksum_frag_list(const struct sk_buff *skb, int = start, + int offset, int len, int pos, + __wsum csum, __wsum *csump) +{ + struct sk_buff *frag_iter; + int copy, err; + + skb_walk_frags(skb, frag_iter) { + int end; + + WARN_ON(start > offset + len); + + end =3D start + frag_iter->len; + copy =3D end - offset; + if (copy > 0) { + __wsum csum2 =3D 0; + + if (copy > len) + copy =3D len; + err =3D skb_checksum_full(frag_iter, offset - start, copy, + &csum2); + if (err) + return err; + csum =3D csum_block_add(csum, csum2, pos); + len -=3D copy; + if (len =3D=3D 0) + goto out; + offset +=3D copy; + pos +=3D copy; + } + start =3D end; + } + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EFAULT; + } +out: + *csump =3D csum; + return 0; +} + +/** + * skb_checksum_full - checksum a range of an skb + * @skb: buffer to checksum + * @offset: offset in @skb to start at + * @len: number of bytes to checksum + * @csump: the sum to add to; on success the range's sum is added to it + * + * Return: 0 on success, -EINVAL if @len is negative, or -EFAULT if @skb + * runs out before @len does, or if the range goes past the linear area + * of an skb, @skb or one on its frag_list, that has unreadable frags. + * On failure *@csump is not changed. + */ +int skb_checksum_full(const struct sk_buff *skb, int offset, int len, + __wsum *csump) { int start =3D skb_headlen(skb); int i, copy =3D start - offset; - struct sk_buff *frag_iter; + __wsum csum =3D *csump; int pos =3D 0; =20 + if (unlikely(len < 0)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } + /* Checksum header. */ if (copy > 0) { if (copy > len) copy =3D len; csum =3D csum_partial(skb->data + offset, copy, csum); if ((len -=3D copy) =3D=3D 0) - return csum; + goto out; offset +=3D copy; pos =3D copy; } =20 - if (WARN_ON_ONCE(!skb_frags_readable(skb))) - return 0; + if (!skb_frags_readable(skb)) + return -EFAULT; =20 for (i =3D 0; i < skb_shinfo(skb)->nr_frags; i++) { int end; @@ -3585,37 +3646,31 @@ __wsum skb_checksum(const struct sk_buff *skb, int = offset, int len, __wsum csum) } =20 if (!(len -=3D copy)) - return csum; + goto out; offset +=3D copy; } start =3D end; } =20 - skb_walk_frags(skb, frag_iter) { - int end; + return skb_checksum_frag_list(skb, start, offset, len, pos, csum, + csump); +out: + *csump =3D csum; + return 0; +} +EXPORT_SYMBOL(skb_checksum_full); =20 - WARN_ON(start > offset + len); +/* skb_checksum() has no way to report failure, so it returns 0, which is a + * valid checksum. Use skb_checksum_full() in new code. + */ +__wsum skb_checksum(const struct sk_buff *skb, int offset, int len, __wsum= csum) +{ + int err =3D skb_checksum_full(skb, offset, len, &csum); =20 - end =3D start + frag_iter->len; - if ((copy =3D end - offset) > 0) { - __wsum csum2; - if (copy > len) - copy =3D len; - csum2 =3D skb_checksum(frag_iter, offset - start, copy, - 0); - csum =3D csum_block_add(csum, csum2, pos); - if ((len -=3D copy) =3D=3D 0) - return csum; - offset +=3D copy; - pos +=3D copy; - } - start =3D end; - } - if (unlikely(len)) { - DEBUG_NET_WARN_ON_ONCE(1); + if (unlikely(err)) { + WARN_ON_ONCE(err =3D=3D -EFAULT && !skb_frags_readable(skb)); return 0; } - return csum; } EXPORT_SYMBOL(skb_checksum); --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825298; cv=none; d=zohomail.com; s=zohoarc; b=bTayMZv+DyeV+AZeqNIuGqxGW7N8xmyNGL8JvQjuzjgL+60+pJQ3Q/uLA7IN82jBHmgeXvNexwkqrmb3hqxYHAAB5d8zmURuvNN66Ii+MXWZchwMlCuPWAgI4kk3BQ/SZTDLcNpAby/fwj4IKxklxNPxmJHFXgUy4d/AYPL6/tA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825298; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=VmZ/3gC03rOFS4IvFRf+urbZu7mk8uManzJKXnUZilo=; b=W0Bj/5ImPBisZie7z2Jb+Qqc177xV6vhDu7B4y6Licl/ii+oHu4GBLN1lEqM7NKmaCriaB/5JadPSKtV47hJj93YLlomd80sHdSbVsOD+i1nCBiOLhtXjR1IbgGxP3tSxWUOUT2iLSQTsCK7dTmwVdnn1ukFGQZfbY1y20zLh0I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825298193826.4167418896858; Wed, 4 Nov 2026 12:48:18 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472758.1680604 (Exim 4.92) (envelope-from ) id 1xOhtl-0003Hs-Qh; Wed, 04 Nov 2026 20:47:57 +0000 Received: by outflank-mailman (output) from mailman id 1472758.1680604; Wed, 04 Nov 2026 20:47:57 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtl-0003Hj-Lo; Wed, 04 Nov 2026 20:47:57 +0000 Received: by outflank-mailman (input) for mailman id 1472758; Wed, 04 Nov 2026 20:47:56 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtk-0002la-AY for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:47:56 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtj-00BcE3-NR for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:47:55 +0100 Received: from [10.42.69.7] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99ea-e002-0a2a0a5209dd-0a2a4507c1e0-14 for ; Wed, 04 Nov 2026 21:47:55 +0100 Received: from [209.85.160.178] (helo=mail-qt1-f178.google.com) by tlsNG-ef75cf.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb99fa-b4ea-0a2a45070019-d155a0b2d40a-3 for ; Wed, 04 Nov 2026 21:47:55 +0100 Received: by mail-qt1-f178.google.com with SMTP id d75a77b69052e-53c4b82919fso14039711cf.0 for ; Wed, 04 Nov 2026 12:47:55 -0800 (PST) Received: from toxicpanda.com ([153.61.196.255]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-54b10a7006asm33796401cf.17.2026.11.04.12.47.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:47:53 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825274; x=1794430074; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=VmZ/3gC03rOFS4IvFRf+urbZu7mk8uManzJKXnUZilo=; b=ER7WJ2KxQWtLg8ehy0NfGsVeGwsog8MGdRF3EP8g08Jy2JS8G+gfrch38webm5p2Sv QxjHPk8i7+/m9bHXUt3yHMwC1StY6fqmzapJrJUrcMCp9rikF7a227SqWmaSEyTjzTTB 0olHFJP7Cr+1DDbt3ZU9vp72TR6Wc0saunwqmUTHvDfiF1oWbx36Yms359/gPrkhFPPa /eJozkvX++34c0FinZXJOTpmQs9K6AeMhr52vbSTejOBd1G/3Kpot79awyyM3zGnaW4D Lg/zWDBYq+JOLTbX6ClxpJllUF0UO3/GXIwiSYODW/TsBMCy4A6nshfZumdwujoQMbZp fUeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825274; x=1794430074; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=VmZ/3gC03rOFS4IvFRf+urbZu7mk8uManzJKXnUZilo=; b=FWEcPHOTUdmuefWrEVuA2RGi4JLXrEivBwcTK3kyF3T57EoNRxwBOc8zZqhalPWxaJ bQS743wEv7vsaTo10cb8bA2KLXeIZwmQoypcO/Z+1FxCOPCpVFzSaT+/mt/xI6+AehX1 HwrL3rkUhW9mIIvz7q1dnRC27zY5ClrqRD5xcwSoiOJY7n+kOUZelaXVwNMYK2qCZjL6 L7aAQ791mXmEgGESAcTkdZdETqwy5GiiehXGpIUt2RAmYSWQbeu/ugnVTKh6EWB+rtbi XRgOW+ApKo69dKHAPQHylx+l5CUORGx5PfRh0TaFR1sPSKExwuaIYNoGkXUjJtKSzsSj chDw== X-Forwarded-Encrypted: i=1; AKwUvByXYOeK6BwB+Ecb0x0z+l/pWYD9cArbBcgSlNVU7PSHp7DIAxKXGMpJZq0lWRkj4Wjk3qFktwOXTB4=@lists.xenproject.org X-Gm-Message-State: APuU4Z/cGCX88rtqeGcV/Q6Ze8hNZXk0p08LdSPoPV6NxLSz/6ufcMep tkgpff3O4XmBdh7+41BBk5peMvsxH3FkszsOvx1gY63qtr9/4dufsFkCdoqINFP1WLA= X-Gm-Gg: AYBFou1qXZnUYSNuykV3FyU54Drh7FspFgBYMa4N20ydS6A2O9rSZtTehp/OgiORHJ2 dZxphz9RwNdL651KGSIkZY5z2hqmJalidhDE6b7nmQKzt4ylp2NypHqL03WLmh1X/Z3QII6YoHY KRqeGnkPb77iLPAbVW4DgmIPgpiX4mEUskE4HFZ/9/ZNRYMylSFOQb0QqdklcToMZ9Oa+05r8oi 0/JyERlEMJUePWinnwRQIQnW5gYeZevkJZ9z9zFBAFpa1RS41BiRsP1dinhe+DPaZ/HynFYuB3Q MJrRIMIH9qynKT+GarMh27XiNeuYdi9Pv29JLuvGpIyq1OYOhvUI49YF3402BNBCj5uDvq8pWd3 x5Zux5ez8tBHsnTgTYpdsmGeleKN0NuufaKJyHvxn4Qy/574LmvDS97qL41lrp/Ufar3ePicT5D yq+DtJHfsNlASEdOqzH/J9fw4kWQK1htuFKZLkSVVed150J9pktvvK7Iu6zSy772/m32yqrkWph 0u2M53ZDhnOvv6tjKHItjLmwPkLNeZuGmaKqSFqEuBFjfFV8CHmeWwGzawZ16LI39a9p0dRa+2D /po91z80Yuaa6AeLzCo7mCoRINsDdP+5S5RTZPn6BprUlg== X-Received: by 2002:ac8:59d3:0:b0:536:3a49:f76 with SMTP id d75a77b69052e-542b62a60f2mr301290451cf.27.1793825274007; Wed, 04 Nov 2026 12:47:54 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:15 +0000 Subject: [PATCH net-next v4 03/15] net: skbuff: fail checksum validation when the skb can't be checksummed MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-3-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825268; l=5641; i=josef@toxicpanda.com; h=from:subject:message-id; bh=Lx+sg563Gwi7/eqkbjWaelHQ+u2/rBUxkXNgf6ZDN3A=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QIBEqqq3ka7HmeaWWRJD2T+myoIbf+nMkpwdF2b0vlJsA0tYmEFfRvaeCBuvlGjyE/GzzQk+iqN 3kCfR/y6KEwc= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-ef75cf/1793825275-A6EDEAE4-9DED2C98/0/0 X-purgate-type: clean X-purgate-size: 5643 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825298839158500 __skb_checksum_complete() and __skb_gro_checksum_complete() verify a packet with skb_checksum(), which returns 0 when the payload is in unreadable frags or the skb's lengths don't add up. Both add that 0 to the pseudo-header sum, so they accept the packet whenever the pseudo-header sum folds to 0xffff. The sender controls that sum through the addresses and the length. Use skb_checksum_full() in both, and in __skb_checksum_complete_head(), and report an skb that can't be checksummed as having a bad checksum. Also take the skb off CHECKSUM_COMPLETE on that path. nf_ip_checksum() stores the pseudo-header sum in skb->csum before it calls __skb_checksum_complete(), and conntrack doesn't drop a packet with a bad checksum. If the skb stayed CHECKSUM_COMPLETE, __skb_checksum_validate_complete() would add the same pseudo-header sum to skb->csum and accept the packet under the same condition. A test module builds an skb that claims 50 more bytes than it holds, with a pseudo-header sum of 0xffff. Both functions accept that skb before this patch and reject it after. Found by the Sashiko AI review of the BUG_ON() series. Fixes: 20ddd0fd2fcd ("net: skbuff: don't BUG() on leftover length in skb_ch= ecksum() and friends") Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f73289= 5b@toxicpanda.com/ Link: https://lore.kernel.org/all/179273111951.3134.3452028799437573017@ker= nel.org/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- include/linux/skbuff.h | 4 ++-- net/core/gro.c | 11 +++++++++-- net/core/skbuff.c | 27 +++++++++++++++++++++++---- 3 files changed, 34 insertions(+), 8 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 608c1491597e..5a5354a6b6ba 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4892,7 +4892,7 @@ static inline void skb_checksum_complete_unset(struct= sk_buff *skb) * 0: checksum is validated or try to in skb_checksum_complete. In the l= atter * case the ip_summed will not be CHECKSUM_UNNECESSARY and the pseudo * checksum is stored in skb->csum for use in __skb_checksum_complete - * non-zero: value of invalid checksum + * non-zero: value of invalid checksum, or 1 if the skb can't be checksu= mmed * */ static inline __sum16 __skb_checksum_validate_complete(struct sk_buff *skb, @@ -4932,7 +4932,7 @@ static inline __wsum null_compute_pseudo(struct sk_bu= ff *skb, int proto) * * Return values: * 0: checksum is validated or try to in skb_checksum_complete - * non-zero: value of invalid checksum + * non-zero: value of invalid checksum, or 1 if the skb can't be checksu= mmed */ #define __skb_checksum_validate(skb, proto, complete, \ zero_okay, check, compute_pseudo) \ diff --git a/net/core/gro.c b/net/core/gro.c index 1b033855a20d..e2e847c95270 100644 --- a/net/core/gro.c +++ b/net/core/gro.c @@ -798,10 +798,17 @@ EXPORT_SYMBOL(napi_gro_frags); */ __sum16 __skb_gro_checksum_complete(struct sk_buff *skb) { - __wsum wsum; + __wsum wsum =3D 0; __sum16 sum; =20 - wsum =3D skb_checksum(skb, skb_gro_offset(skb), skb_gro_len(skb), 0); + /* If the data can't be checksummed it can't be valid either, and + * NAPI_GRO_CB(skb)->csum only holds the pseudo checksum. + */ + if (skb_checksum_full(skb, skb_gro_offset(skb), skb_gro_len(skb), + &wsum)) { + NAPI_GRO_CB(skb)->csum_valid =3D 0; + return (__force __sum16)1; + } =20 /* NAPI_GRO_CB(skb)->csum holds pseudo checksum */ sum =3D csum_fold(csum_add(NAPI_GRO_CB(skb)->csum, wsum)); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index d51fdcb3e016..0082b12544cf 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3885,11 +3885,28 @@ u32 skb_crc32c(const struct sk_buff *skb, int offse= t, int len, u32 crc) EXPORT_SYMBOL(skb_crc32c); #endif /* CONFIG_NET_CRC32C */ =20 +/* The data can't be checksummed, so it can't be valid either. The caller= has + * put the pseudo header's checksum in skb->csum, so don't leave the skb + * CHECKSUM_COMPLETE for a later validator to take that for the packet's. + */ +static __sum16 skb_checksum_complete_failed(struct sk_buff *skb) +{ + if (!skb_shared(skb)) { + skb_checksum_complete_unset(skb); + skb->csum_valid =3D 0; + } + return (__force __sum16)1; +} + __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len) { + __wsum csum =3D skb->csum; __sum16 sum; =20 - sum =3D csum_fold(skb_checksum(skb, 0, len, skb->csum)); + if (skb_checksum_full(skb, 0, len, &csum)) + return skb_checksum_complete_failed(skb); + + sum =3D csum_fold(csum); /* See comments in __skb_checksum_complete(). */ if (likely(!sum)) { if (unlikely(skb->ip_summed =3D=3D CHECKSUM_COMPLETE) && @@ -3909,14 +3926,16 @@ EXPORT_SYMBOL(__skb_checksum_complete_head); * * It returns non-zero if the recomputed checksum is still invalid, otherw= ise * zero. The new checksum is stored back into skb->csum unless the skb is - * shared. + * shared. If the skb can't be checksummed it returns non-zero, skb->csum = is + * left alone, and the skb is no longer CHECKSUM_COMPLETE unless it's shar= ed. */ __sum16 __skb_checksum_complete(struct sk_buff *skb) { - __wsum csum; + __wsum csum =3D 0; __sum16 sum; =20 - csum =3D skb_checksum(skb, 0, skb->len, 0); + if (skb_checksum_full(skb, 0, skb->len, &csum)) + return skb_checksum_complete_failed(skb); =20 sum =3D csum_fold(csum_add(skb->csum, csum)); /* This check is inverted, because we already knew the hardware --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825304; cv=none; d=zohomail.com; s=zohoarc; b=SbBV7mjK12nHadG0yBQ/cgWVGAS2wXOkMCJOq56pgKB8z5+1Trljw+0ev8OWfGRk7XQHPiE9G7Bbeyt2N7W8bfrCl1wQ8TWZgF4Q1CaY2wlRQqfgCsgylyFMv+6uck4vm7SxzrgRiY5xou4iTP07Bex3s8zJgal53Y4OUcLr4vg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825304; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Z0ofG8i+5G3+D6Lky4QQ+QewxWtJgEdu+4PNn/sRjok=; b=CbK9DUK+R+53lC9eXSXe+0rsF4O2Fnd3/XkVP6ekAGq+qjq0y8CF5Tpb+Lt6UbsYqRZ5Ot18989WN9rRGV0De3VQ/7fZOByHnqdETBaG36tZmY8VnlVT8lBNsLFnOtPf/p5/wMc1yEIO17lj15ciX/Nfq3qOr9jtaRZbSkM2Sz8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825304523338.83534884998255; Wed, 4 Nov 2026 12:48:24 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472759.1680613 (Exim 4.92) (envelope-from ) id 1xOhtn-0003W7-21; Wed, 04 Nov 2026 20:47:59 +0000 Received: by outflank-mailman (output) from mailman id 1472759.1680613; Wed, 04 Nov 2026 20:47:59 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtm-0003Vz-TR; Wed, 04 Nov 2026 20:47:58 +0000 Received: by outflank-mailman (input) for mailman id 1472759; Wed, 04 Nov 2026 20:47:57 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtl-00037q-ID for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:47:57 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtk-00DUt0-Nq for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:47:56 +0100 Received: from [10.42.69.8] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99da-2eae-0a2a0a5409dd-0a2a4508964c-44 for ; Wed, 04 Nov 2026 21:47:56 +0100 Received: from [209.85.160.177] (helo=mail-qt1-f177.google.com) by tlsNG-c1860d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb99fb-f659-0a2a45080019-d155a0b1dc8f-3 for ; Wed, 04 Nov 2026 21:47:56 +0100 Received: by mail-qt1-f177.google.com with SMTP id d75a77b69052e-53634b8328eso9650621cf.0 for ; Wed, 04 Nov 2026 12:47:56 -0800 (PST) Received: from toxicpanda.com ([153.61.196.245]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91e7e728f87sm28503726d6.36.2026.11.04.12.47.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:47:54 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825275; x=1794430075; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Z0ofG8i+5G3+D6Lky4QQ+QewxWtJgEdu+4PNn/sRjok=; b=kr0H6+XKXUvBB2A5SCmhTrbHwCLJhC4CcSo4QA4uX9M7rcDpK3s39jUQHEEhfZM1F7 BBbIA2meHQHICMjoe0+WLNimrc74eP+pBm8YVUWzVcPcDhtFeKnaLnaLjbFGiy8buyVW EwTMH5cfvc7l4rPTcUISC+7AIIm70TqIwCA0K2gZQPvfpGq6cQZGUmpkx5hP7QlFtnU+ VzQqdpApNxBYgyOFx+N+9t83tcL/Jv477Ru1EVIKFCvas70ZWOxTiUug37L5T3oseQq1 SxSEmlsWCRPoRCdvpgFS94C8fACcr/V0qfN9WXYEWNI10q53puxt5wfaMNJaQMjukh1Q f5mg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825275; x=1794430075; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Z0ofG8i+5G3+D6Lky4QQ+QewxWtJgEdu+4PNn/sRjok=; b=KM19QDiaqw1hSNa3FEv8Hsn+kHXJjyhkUTH1p+uP4pfQpJeycNrut+Wv6tDAC9hrlF R+2zNsgrGvqEphfK3jnA/ale/J6kLlyNwu0ygFFtW+FJzVdPv5sfZORMQRUugFwrEKht 0/5v55Hq2Y9xA2iWG8B9k7l7/YILpobNlXo4ynNQr9n+AZ8hymrXNsjWZ9RNjNy6Q2rN DbxRoZllRvbB1H97UJS90oFuYsBN0KYvV9Lxj9TSgt9xr2P2SxP5O1JaPdiTXePGCYKO ShQlZ+nLgsHaqIqnBaGjxMdhbzR5Inp0NbYCK1epYoxsl6zT+rD2jsnr6sH30MNepz3l bhfg== X-Forwarded-Encrypted: i=1; AKwUvBz+JiBt3e6boRMxN7aQk3vWWFAj/5weXS+B0QEodhBpC2JvtwnsvzzjEMRWy+Cz5DlaOOhdawgrXdE=@lists.xenproject.org X-Gm-Message-State: APuU4Z/rUgg5PCN0yxxfYf1WV5en0yJ6ODVLyxjR2u7rTHc+xhDLxMzr BQGCrPlcbevLJRE81pGC5ZDqho5FRdFCz7SilrVDEsIfwEFB/mtFA0h4AkimJYhZv0o= X-Gm-Gg: AYBFou0uQSAJ17PJJy1WX5d7VLiJnpoSR0GaazvDi84ixUbOk5TO/ATMjLxf7fqncKG ZHdK1DKVROIMecfDNYPC9MqoxPmp+e7ojURLZUhxTRRIIvhrTJWe4F8Pii8TBMRLYvjyJ1i8DYT hvOiu2vJ8MlgqSmw4VK7veX1F/uST4O8gsi7JytJmbRj2mW9qVvhYhp2EmINcspUva8B8gTFh6N /Vtlm5jt1ssZeRvJjkTmYNFlS3qsanKNa3T2pdqTDwlHSYGGHpxr2p8c6EDo8hqzL16cfbc7+g/ JAl9iBuCn52Cr1zbluWxZ/1XhFY02vH2njCDN84LbOVB2da8bBHEo00lvWWsy3UZWmssGuncs7g GRNFaZ8eqveIaZjGUDEBpoawuQo8SAk8w5EF7HCEjoZvBHT/mo1NIA+udq45yXHpBePQIIgic8G eJ2Bo9tn4hRytYDm8GGRKm6NZ2kL1ZWLEUbH0x+dmA0cU7KBz++0VBvIlGnPd2tSO1+XgOivLeB SJ+IWe5fo2Cpm/8FxGYUQN63n4I3TCbgxH3PAEl3Z/lmH2XTOU0+gek0brZC6OasLWEh4lSSvCd X8N+qMUhcEPapr32FxSEo1RJQ6NrfsHO2uxzUkqQNiZQTmRFkxS3rpB5XCONgCz+MRc= X-Received: by 2002:a05:622a:5b88:b0:53f:a444:dc7c with SMTP id d75a77b69052e-5489bf4ed8dmr148147081cf.56.1793825275132; Wed, 04 Nov 2026 12:47:55 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:16 +0000 Subject: [PATCH net-next v4 04/15] net: skbuff: fail segmentation when a segment can't be checksummed MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-4-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825268; l=1797; i=josef@toxicpanda.com; h=from:subject:message-id; bh=wq7jmBov95d1ubPFIBwmfjjLdm8phK81PlxkHkS1v7k=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QC+K6YoFA8/X2w62wsZpb6RlJydDVfMR0awgE6H/Srw2FuCPuHi1hJdV2my2TnKDRzcBlXa3JFb 7M90ontNv/wM= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-c1860d/1793825276-CD34D87B-35A2638F/0/0 X-purgate-type: clean X-purgate-size: 1799 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825304899158500 When the device can't checksum the protocol, skb_segment() checksums each segment with skb_checksum(). If the segment has unreadable frags, or its lengths don't add up, skb_checksum() returns 0 and the segment goes out with a checksum that doesn't cover its payload. Devmem TCP doesn't get that far today. Its skbs take SKBFL_SHARED_FRAG from the zerocopy uarg, so skb_segment() tries to linearize the segment first, and that fails with -ENOMEM for unreadable frags. No other path is known to bring an unreadable segment here either. Use skb_checksum_full() and fail the segmentation with -EFAULT, so that the checksum doesn't depend on that flag. Found by the Sashiko AI review of an earlier fix for the same path with SG off. Link: https://lore.kernel.org/all/20261009-b4-skb-segment-nosg-unreadable-v= 1-1-7e2334a55fe8@toxicpanda.com/ Reviewed-by: Fernando Fernandez Mancera Acked-by: Mina Almasry Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 0082b12544cf..43bfaa010db7 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5294,9 +5294,13 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, =20 if (!nskb->remcsum_offload) nskb->ip_summed =3D CHECKSUM_NONE; - SKB_GSO_CB(nskb)->csum =3D - skb_checksum(nskb, doffset, - nskb->len - doffset, 0); + SKB_GSO_CB(nskb)->csum =3D 0; + if (skb_checksum_full(nskb, doffset, + nskb->len - doffset, + &SKB_GSO_CB(nskb)->csum)) { + err =3D -EFAULT; + goto err; + } SKB_GSO_CB(nskb)->csum_start =3D skb_headroom(nskb) + doffset; } --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825297; cv=none; d=zohomail.com; s=zohoarc; b=a8hNyLHS38Y0ZjgeyQ2QEpgFDkBqlnphMeVeDg/ebGVxeQd+DPn96fkm1kJHl3gyGGRgV1JX44TMprjk5/f26miXdNkXVFDOoAmZQjZlbl8wuYiuEqEhzzzVkyugpC7nyRWnWAnGdg4Upb3L0Il9MxMIEfEGa4RQZ61XGAXPdQ8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825297; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=76u0opG5lCQGub1g5v24NFjQ04Vm85vyhWc2VR6fzD8=; b=bEuwxVGJUWhO4LvrM6/OO5lhV84KIU62umRiJAWst0gCjwEoGUhrrcY3wbFlxr/Ph4MYtF8rl0FG3F4m+hHxWYlyUtfAL/ecHyFdm2ObxSAkvYodCjmXPEBU0J4FTfZXNZPAtSke4XkTlHnP/uuSFa7AEViZvwRSB6gvG61/hXg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825297724950.2568573277089; Wed, 4 Nov 2026 12:48:17 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472760.1680622 (Exim 4.92) (envelope-from ) id 1xOhto-0003kg-8f; Wed, 04 Nov 2026 20:48:00 +0000 Received: by outflank-mailman (output) from mailman id 1472760.1680622; Wed, 04 Nov 2026 20:48:00 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhto-0003kO-4j; Wed, 04 Nov 2026 20:48:00 +0000 Received: by outflank-mailman (input) for mailman id 1472760; Wed, 04 Nov 2026 20:47:58 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtm-0003Lw-7m for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:47:58 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtl-00FYWL-K6 for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:47:57 +0100 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99e8-bab6-0a2a0a5309dd-0a2a450c9a30-22 for ; Wed, 04 Nov 2026 21:47:57 +0100 Received: from [209.85.160.178] (helo=mail-qt1-f178.google.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb99fc-f479-0a2a450c0019-d155a0b2d9a2-3 for ; Wed, 04 Nov 2026 21:47:57 +0100 Received: by mail-qt1-f178.google.com with SMTP id d75a77b69052e-533778ab0bdso11880941cf.3 for ; Wed, 04 Nov 2026 12:47:57 -0800 (PST) Received: from toxicpanda.com ([153.61.196.245]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-54b1086db63sm33603081cf.11.2026.11.04.12.47.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:47:55 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825276; x=1794430076; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=76u0opG5lCQGub1g5v24NFjQ04Vm85vyhWc2VR6fzD8=; b=nqYZXPQIbVE8MlPOwSsMgmbBKf6H8K7DShEFiBS4hvEnVH8PL1jQPPq9wb+eSRJVXa Bcezo0p8/lEuPF2ToBi6NSIv8wRyabdpGdifen0IBNN2WD/1qdYfXFaOGJe8ChNWZ+fk hogAu/2YJ722DgpIkCUndRQ78BVcTKskRG0VnVcSCdMFWFZU/D6zL47rkJNoio2EtD0c pxh845KqMzoytr53/u4rk/LLxmrnUJJxbivqKOq+dN+k9VlGAwdpk3EQNlwf5ht7Wa0L pHf3oKseuiOJFR5xl+Hn4fuy8BgeKhK8vfh9NUnsHRQOn52DKYulcA+8dArjV3b9R33x Omkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825276; x=1794430076; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=76u0opG5lCQGub1g5v24NFjQ04Vm85vyhWc2VR6fzD8=; b=exzmnWI/xL0ZQ+VUg3p/wVDnxh0iFYPfFXMEWOTgbmHHiizAEKoCBgsG7nalb3g8mB ycQmq16fTLlXPXxqpM+JRN+lLydCED2bVpHFIV1Szh9l7bZUnT2SeUfwfMRksXrQzM14 gH6B/E0mFLEy4yUkvoz5MY6Qc4EEqn3GDdadODbGeYu6g5hiMj7a0z51koLOm7/UdFYB TiwdIamWxsnJkkxOS87jwo6sNbnTR+hzknqtTKnqYG26GlR02kFK71ZYWy0Kj69EeYZ8 END0cg6LVyfSy092HFGHj7cusO3RbwCfMOfcXc/Xb0s/98sFIx5OD24cN8dIX+3SmkFT cxWw== X-Forwarded-Encrypted: i=1; AKwUvBwdkPa0W9yUgFI2qebSYhQ+EaMiz3pt5u0uROtrTdwur4HFCZ04yNmkmDfSq3B1wOpE5MChZKJEQ1I=@lists.xenproject.org X-Gm-Message-State: APuU4Z8Lzk6kkdVpOPdDW7mjsa9qys0cHy/rkTstYzLCKJr7c3TvP+6e WmTkcgFOfja9ERqGcpEZi1ZIi6XVb+vO5w8Q6+my5fhOAU8YmHCi/7aCCg1no3kGRkM= X-Gm-Gg: AYBFou34k0cuJLMyA3G0f/M6erh+R/WcKUbio+ESV4zp/Z25xEAprpFk/5ELx13K8xB mkA6kj/HOSTYms53iq8qW3P0nNEIBig+0ANQGm+E0wOAuBJIPNm2FSVwxsEInn6r7hakjU8CffW VnAiHHLXCNnU3FCyEoMfJXlJsr3FsGfEcKeYDQ+686nCxS3egzJk9V9RsoVnE8fn2INB1TS5axc 1ddS/4utP1zPAQa/hNlauFBQEEDI13s6N8XmBzjhIa3RfLkGQW7LPDXoxzYZU0bGklyzbhNpLiX 6rWjB5Qaj4wSvOzgdYkqab1IOshXGvP1Z4Xc6K95AUMiWiLyrOgWU8P/uCL44LeFriZuDwuWdCF soEkxD8loiiz58xaFOg0QFTnxuJ5n5Rz6DPXBKAY5YRHAHUtKWa5amWcwVKkWd8zn0QxJPwBZRC +3ncdho5EWTlPpf+vXUhT40wpwp64HvAXERfM8Dnq4BEKSNYvXheKSfUziZyLanUqPRLkrdADSs nKnB9ulSx3gyO1oLU3WGhcY4UwZY4CFshEsbB/XbgEisQsGbyOP0HE+dVeTuA8pLA+ca941QwVu 9nKP5wP87xrEXK0U25ZMewn+bT00CZ+uL9oBEf6T+PWZRQ== X-Received: by 2002:a05:622a:164a:b0:535:20ea:cefe with SMTP id d75a77b69052e-542b639cb3dmr296202871cf.18.1793825276187; Wed, 04 Nov 2026 12:47:56 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:17 +0000 Subject: [PATCH net-next v4 05/15] net: skbuff: drop hw csum if trim can't checksum tail MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-5-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825268; l=2083; i=josef@toxicpanda.com; h=from:subject:message-id; bh=VhuNRWOW3RZfgkvn1rBlfP7PvQEEgt9QwL/nWscgVi0=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QEREoQ9M5gk5NXv0IYrsYL5d3xD0iqwQBzSWkwyENQ0s2oG9H/Gc4OPqk98ZP46iyupEQkfEnKm OaNK0sIyfUgQ= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d25034/1793825277-02EDAA5B-EAB0FD4E/0/0 X-purgate-type: clean X-purgate-size: 2085 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825298795158500 For a CHECKSUM_COMPLETE skb, pskb_trim_rcsum() subtracts the checksum of the trimmed bytes from skb->csum. It gets that checksum from skb_checksum(), which returns 0 if the trimmed range runs into an unreadable frag_list member or past the end of the skb. skb->csum then still covers the trimmed bytes. commit 2e357f002c61 ("net: Avoid checksumming unreadable skb tail on trim") handles an skb that is itself unreadable, but not a readable head with an unreadable frag_list member. Use skb_checksum_full(). When it fails, do what pskb_trim_rcsum() already does for an unreadable skb. Set CHECKSUM_NONE if the remaining packet can be read, so that software checksums it, and fail the trim with -EFAULT if it can't. The stale skb->csum was only reproduced with a hand-built skb in a test module. Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Fixes: 20ddd0fd2fcd ("net: skbuff: don't BUG() on leftover length in skb_ch= ecksum() and friends") Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 43bfaa010db7..66ba9bfa8fc7 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2821,9 +2821,23 @@ static int pskb_trim_rcsum_complete(struct sk_buff *= skb, unsigned int len) int delta =3D skb->len - len; =20 if (skb_frags_readable(skb)) { - skb->csum =3D csum_block_sub(skb->csum, - skb_checksum(skb, len, delta, 0), - len); + __wsum csum =3D 0; + int err; + + if (!skb_checksum_full(skb, len, delta, &csum)) { + skb->csum =3D csum_block_sub(skb->csum, csum, len); + return 0; + } + + /* The trimmed bytes can't be checksummed, so skb->csum can't + * be adjusted. Software can checksum the remaining packet + * after trimming, as long as it can read it. + */ + csum =3D 0; + err =3D skb_checksum_full(skb, 0, len, &csum); + if (err) + return err; + skb->ip_summed =3D CHECKSUM_NONE; return 0; } =20 --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825308; cv=none; d=zohomail.com; s=zohoarc; b=ghfX+lhdj0Aty3Bgp+yzfmpW3LIKinAryX7SD+CTk7AWPfJ5dAXy7E24AbUs14zjZkIQQ9Dxa+Pj8tagzgSK2/qOqShRHqyeUHcTvCYbq8vrqaBcWWl7EqG1ysoNOmKCqSaJvVEn1776F90N8KWsiq97P7OV35IAjH9iMCnrJLY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825308; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=2iqbyIbqll56rZUjTWyhCsGjkAY8FnoBuOzACgDTjoA=; b=KoA6JnF9ZJZ+3tQTffwtaH/E948MpHZ5vLQWyWYU9nEzx25wFHtJyFyfbewI8BIPjCiD3Hh8gQGBUtZov7jJ+5k7fnDEDZfge5EbQ72fkRKFF6f/IGUCjgitNGNk2js3o0zvCKMkQCSGyKVqTMkfZRW8m/+n5nhoXj748UeDMBU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825308806719.9777099039092; Wed, 4 Nov 2026 12:48:28 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472761.1680627 (Exim 4.92) (envelope-from ) id 1xOhto-0003og-Pb; Wed, 04 Nov 2026 20:48:00 +0000 Received: by outflank-mailman (output) from mailman id 1472761.1680627; Wed, 04 Nov 2026 20:48:00 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhto-0003nn-Ig; Wed, 04 Nov 2026 20:48:00 +0000 Received: by outflank-mailman (input) for mailman id 1472761; Wed, 04 Nov 2026 20:47:59 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtn-0003Yk-D0 for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:47:59 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtm-000QZ3-Pp for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:47:58 +0100 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99a0-8faa-0a2a0a5109dd-0a2a4501dd76-46 for ; Wed, 04 Nov 2026 21:47:58 +0100 Received: from [209.85.222.173] (helo=mail-qk1-f173.google.com) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb99fd-5984-0a2a45010019-d155deada5ca-3 for ; Wed, 04 Nov 2026 21:47:58 +0100 Received: by mail-qk1-f173.google.com with SMTP id af79cd13be357-945ae2daa68so118183685a.1 for ; Wed, 04 Nov 2026 12:47:58 -0800 (PST) Received: from toxicpanda.com ([153.61.196.255]) by smtp.gmail.com with ESMTPSA id af79cd13be357-945d4899dc6sm291976285a.43.2026.11.04.12.47.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:47:56 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825277; x=1794430077; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2iqbyIbqll56rZUjTWyhCsGjkAY8FnoBuOzACgDTjoA=; b=Zs1KVzpAla11JYbnEPduhouBUUPhE2/iTv8I2QsNcxPsYqCnCohWlqAXxIOnjp6iMK 30b8RxswdEmFo8Z6n8MhgEHdqzzji6mHpNXQxacavAMS3gs2QNqlJuVcTeAo9dzBYmQG S1VLMJOcjqe6/QdO27s5tYr0Zfr6dxSr5yqM6NnqrF/5BDiOigu6qsRsXKD4Z5LZtEgK QeAWoUivNWgjd7ZmetFBn8Ebp2xJ5YZwh9IHvzWLDfQkPNMV31X+LDE2X+sFW0LAMBSa x/bUbcGwK1xLmapcKy+vYQbTWdHemdy1sjGMkXIQrymHqLkeYsxJSy1shILhTVvAk+dk JFsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825277; x=1794430077; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=2iqbyIbqll56rZUjTWyhCsGjkAY8FnoBuOzACgDTjoA=; b=sOVKiRmLExLY3/2lslr1tuB9yqKcwnjTZOHFXPHQfZ7pbkW5dSmr/5vp00jfCc77LS d4RQmmFMPN6Cxri+0CAH21iiRPPMzIwBFk9MZQXLU5UnwLhyV3DjINmkTLX6/JqpbQKa 6L1DQ/xPOrZhY81zUgQYMfB1KOb1LIttJgxlp/k0O7zxYOHWAq2P2RLHtnc2rkdF73eK 5q0GCSjLIvbSznxLf4rVH6+AYk/gVQHrh65KcxBrJJrGDAGeTZxCpfyuIDgJX5p5P5nS yzNAl9DtX9QzsTzFOECVoOihOMSTz4EiFJOEQnGvFawTr8PeQEzi5jbobmgtlDEaF6U9 fI5w== X-Forwarded-Encrypted: i=1; AKwUvByCARWgxvQVFUyIQr/BKuD1CEngKn7jizT+CZ/yF2rYok5gwA/lWfbO0i1/3I5Xs3j1BSazB4ZYxIk=@lists.xenproject.org X-Gm-Message-State: APuU4Z8ay5A7SjkRHbrRwE4/eqZk2cil0iJjgsdhGZnJJ6oku7sf7SDt j4fdHKFAl9aLeN/OzerOPfFnZCTA6OJmAcq13x0r5HUnfw9Noo/Bg+Bmogk8v0io/S8= X-Gm-Gg: AYBFou2gjulltGmhcvzGML3pu31pb+IJAhCCfkpKjrHho8CC+ZwL1ufxYhE4wiDaceV J8kjtIyLL3s6RIgK5bySWYZiFozdbtxE/NfnbHJZkCviPCL0sI4G8A6UsLbcOxs4D8miuj6iO+i tce31n51O+dyX6iTVuN6dJmIt4iY4XL7i0vEsWE2IP03h7Is0Eeza417LaHZc+2cN1wAmh+VB09 4nT4JH9ke4g2KcjsLRTifLSNillMFxKpeOfKfqRgcZrdajJZ7zL7eBSzxViJVY6TqfULd9s9NLU z6Au5314bKRzIU3DS3UkPrJ7cMhp+W8Gm6CyXN6w/i8i+l3/97av5J/g3LwkN3EW+s35knTnUt/ TSCOVrj2Qvq2EkcRYSjcFgXTq4AiO8FJt+fV3TIiFtPjGeSITr1PAnXXSxQOReNeSR4Zo1FKJRC BWhoS8a0YaagjmJmGf/lMGrb/+IK19ZU43Nk9j0x1dG4cCl3CRMoYmYN+3dGwkx9rUGY8XHQWIv +YeXNYeLUE4tCbAVnU2msthARF6D88v7gtooeTr2I6NlSLmM9k5mPsa5sCpFC0EoAXuNmR+Hur8 vxskKciGkPsrTxusb1vznUnNNzxREeBJwFm6LNTpUED+6w== X-Received: by 2002:a05:620a:2788:b0:93f:3834:31f9 with SMTP id af79cd13be357-945e16aa3e7mr108928085a.12.1793825277204; Wed, 04 Nov 2026 12:47:57 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:18 +0000 Subject: [PATCH net-next v4 06/15] net: skbuff: add skb_crc32c_full() that reports failure MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-6-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825268; l=5927; i=josef@toxicpanda.com; h=from:subject:message-id; bh=DmjhWQ5DbJzFnm4Wwg1TpS3SDY+QYZAOw6lUp58u+o4=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QBjRiNxwpgAKwONkFhB+BneqX78IwJRr+LyApr85bnefV3HRAkCkhFAn5Dl/gju2+QcLKWjlQoe FEZd97LNDlQ4= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d62444/1793825278-1DA7E757-58C06D0E/0/0 X-purgate-type: clean X-purgate-size: 5929 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825309162158500 skb_crc32c() has the same problem as skb_checksum(). When the range runs into unreadable frags or past the end of the skb, skb_crc32c() returns 0, which is also a valid CRC. sctp_compute_cksum() and skb_crc32c_csum_help() complement it, so a failed walk looks like a checksum of 0xffffffff whatever the packet contains. Add skb_crc32c_full(), which works like skb_checksum_full(). skb_crc32c() becomes a wrapper for the callers that aren't converted yet. The wrapper still returns 0 on failure, but it no longer warns when only a frag_list member has unreadable frags. Convert skb_crc32c_csum_help(), which can already return an error, so that an SCTP packet that can't be checksummed is dropped on transmit. The other callers will follow with the skb_checksum() callers. Fixes: 20ddd0fd2fcd ("net: skbuff: don't BUG() on leftover length in skb_ch= ecksum() and friends") Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- include/linux/skbuff.h | 2 + net/core/dev.c | 7 +++- net/core/skbuff.c | 100 +++++++++++++++++++++++++++++++++++++--------= ---- 3 files changed, 83 insertions(+), 26 deletions(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 5a5354a6b6ba..5581ed3cbf47 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -4332,6 +4332,8 @@ static inline int memcpy_to_msg(struct msghdr *msg, v= oid *data, int len) =20 __wsum skb_checksum(const struct sk_buff *skb, int offset, int len, __wsum csum); +int __must_check skb_crc32c_full(const struct sk_buff *skb, int offset, + int len, u32 *crcp); u32 skb_crc32c(const struct sk_buff *skb, int offset, int len, u32 crc); =20 static inline void * __must_check diff --git a/net/core/dev.c b/net/core/dev.c index 00a62c391056..f9878db781df 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3752,8 +3752,11 @@ int skb_crc32c_csum_help(struct sk_buff *skb) if (ret) goto out; =20 - crc =3D ~skb_crc32c(skb, start, skb->len - start, ~0); - *(__le32 *)(skb->data + offset) =3D cpu_to_le32(crc); + crc =3D ~0; + ret =3D skb_crc32c_full(skb, start, skb->len - start, &crc); + if (ret) + goto out; + *(__le32 *)(skb->data + offset) =3D cpu_to_le32(~crc); skb_reset_csum_not_inet(skb); out: return ret; diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 66ba9bfa8fc7..96c8835a262b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3825,23 +3825,79 @@ int skb_copy_and_csum_bits(const struct sk_buff *sk= b, int offset, EXPORT_SYMBOL(skb_copy_and_csum_bits); =20 #ifdef CONFIG_NET_CRC32C -u32 skb_crc32c(const struct sk_buff *skb, int offset, int len, u32 crc) +/* The frag_list part of skb_crc32c_full(). It's out of line so that taki= ng + * the address of crc doesn't cost every caller a stack protector. + */ +static noinline int skb_crc32c_frag_list(const struct sk_buff *skb, int st= art, + int offset, int len, u32 crc, + u32 *crcp) +{ + struct sk_buff *frag_iter; + int copy, err; + + skb_walk_frags(skb, frag_iter) { + int end; + + WARN_ON(start > offset + len); + + end =3D start + frag_iter->len; + copy =3D end - offset; + if (copy > 0) { + copy =3D min(copy, len); + err =3D skb_crc32c_full(frag_iter, offset - start, copy, + &crc); + if (err) + return err; + len -=3D copy; + if (len =3D=3D 0) + goto out; + offset +=3D copy; + } + start =3D end; + } + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EFAULT; + } +out: + *crcp =3D crc; + return 0; +} + +/** + * skb_crc32c_full - CRC32C a range of an skb + * @skb: buffer to read + * @offset: offset in @skb to start at + * @len: number of bytes to include + * @crcp: the CRC to continue from; on success, updated with the range + * + * Return: 0 on success, -EINVAL if @len is negative, or -EFAULT if @skb + * runs out before @len does, or if the range goes past the linear area + * of an skb, @skb or one on its frag_list, that has unreadable frags. + * On failure *@crcp is not changed. + */ +int skb_crc32c_full(const struct sk_buff *skb, int offset, int len, u32 *c= rcp) { int start =3D skb_headlen(skb); int i, copy =3D start - offset; - struct sk_buff *frag_iter; + u32 crc =3D *crcp; + + if (unlikely(len < 0)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } =20 if (copy > 0) { copy =3D min(copy, len); crc =3D crc32c(crc, skb->data + offset, copy); len -=3D copy; if (len =3D=3D 0) - return crc; + goto out; offset +=3D copy; } =20 - if (WARN_ON_ONCE(!skb_frags_readable(skb))) - return 0; + if (!skb_frags_readable(skb)) + return -EFAULT; =20 for (i =3D 0; i < skb_shinfo(skb)->nr_frags; i++) { int end; @@ -3866,34 +3922,30 @@ u32 skb_crc32c(const struct sk_buff *skb, int offse= t, int len, u32 crc) } len -=3D copy; if (len =3D=3D 0) - return crc; + goto out; offset +=3D copy; } start =3D end; } =20 - skb_walk_frags(skb, frag_iter) { - int end; + return skb_crc32c_frag_list(skb, start, offset, len, crc, crcp); +out: + *crcp =3D crc; + return 0; +} +EXPORT_SYMBOL(skb_crc32c_full); =20 - WARN_ON(start > offset + len); +/* skb_crc32c() has no way to report failure, so it returns 0, which is a + * valid CRC. Use skb_crc32c_full() in new code. + */ +u32 skb_crc32c(const struct sk_buff *skb, int offset, int len, u32 crc) +{ + int err =3D skb_crc32c_full(skb, offset, len, &crc); =20 - end =3D start + frag_iter->len; - copy =3D end - offset; - if (copy > 0) { - copy =3D min(copy, len); - crc =3D skb_crc32c(frag_iter, offset - start, copy, crc); - len -=3D copy; - if (len =3D=3D 0) - return crc; - offset +=3D copy; - } - start =3D end; - } - if (unlikely(len)) { - DEBUG_NET_WARN_ON_ONCE(1); + if (unlikely(err)) { + WARN_ON_ONCE(err =3D=3D -EFAULT && !skb_frags_readable(skb)); return 0; } - return crc; } EXPORT_SYMBOL(skb_crc32c); --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825301; cv=none; d=zohomail.com; s=zohoarc; b=bZ3F+JyBuN74vUIU2TAptbBxH+XiQZP+fBqwdrxgKagjHcwKfi+JyZL82GGCpRiIWWDXN9Q/LhQSN3nbW4w341e3uuCULhaMMrn3r2izi5DG0XxUgzkv4cANnYZanUA0WPtBVTm7NL0bs0Pu6KjQtRbJlmnUNYze96s5N8MaTUs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825301; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=umuQbJBZ+T+/ul5GPlAUT8hdRrJpMBpkwqdC6QE4K5Q=; b=OmfvTjxxN64uuuFnIwoi7toTbMBBr9farUvhoK6FuI6lqfnkI5hRNiH0l83wy9YiZ+ifRaevj4y8IkCpCQmkzv0De78GQvq+X/sCuYBvRh/G/Zlp2WIzuwAHJVyT2uVwy40xqUj2W/btCxrSOcm0CiRaTq5y17N5N6EJeWNV5fM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825301616625.8226453813206; Wed, 4 Nov 2026 12:48:21 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472762.1680639 (Exim 4.92) (envelope-from ) id 1xOhtq-0004Be-97; Wed, 04 Nov 2026 20:48:02 +0000 Received: by outflank-mailman (output) from mailman id 1472762.1680639; Wed, 04 Nov 2026 20:48:02 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtq-0004Ax-0T; Wed, 04 Nov 2026 20:48:02 +0000 Received: by outflank-mailman (input) for mailman id 1472762; Wed, 04 Nov 2026 20:48:00 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhto-0003lk-Hi for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:48:00 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtn-00DUt0-Ud for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:47:59 +0100 Received: from [10.42.69.5] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99fc-2eae-0a2a0a5409dd-0a2a4505a2d4-4 for ; Wed, 04 Nov 2026 21:47:59 +0100 Received: from [209.85.219.47] (helo=mail-qv1-f47.google.com) by tlsNG-c201ff.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb99fe-4cb1-0a2a45050019-d155db2fa983-3 for ; Wed, 04 Nov 2026 21:47:59 +0100 Received: by mail-qv1-f47.google.com with SMTP id 6a1803df08f44-91c7a706b1fso28851516d6.1 for ; Wed, 04 Nov 2026 12:47:59 -0800 (PST) Received: from toxicpanda.com ([153.61.196.253]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91e7e008399sm28523796d6.23.2026.11.04.12.47.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:47:57 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825278; x=1794430078; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=umuQbJBZ+T+/ul5GPlAUT8hdRrJpMBpkwqdC6QE4K5Q=; b=ln+AOLUMDhKMIQcKf8z/wVpD4VzPzaL1ahG6thz/Q8BfPcZ7ZBedH1+emN9Ebmos69 h5+duzJn7gq++P78hdnyWPZQbk5NirC/O+f9rbMsvGzCFZ8L5eEh/+ctBbzPeAdfoWmu 6qFCY0+VM1YGmsU2QIL/aexycsR4/sEMpKqcDWF31BHKeQIvJG5BAPc3dxrK4ucY8OLn ab5CIKFwVNc3WZK4Mvw8x2DRWojVwGcE+KDCAlCZFcnsLnqBhGk5PYF4rkHqIoSdckwq fFq5OEx1KDAKudEzucUMBcPrkrZGdgL3aVha+tGqB4hIcO3rF4YXb3yiYvZC7wn7IVmK 4zBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825278; x=1794430078; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=umuQbJBZ+T+/ul5GPlAUT8hdRrJpMBpkwqdC6QE4K5Q=; b=rsiXCYeJCbTaFbHFA6IR9hiaCD7W1XBA1Thjl1llcX8csuUZdcasjuSp0/sDUq2IEn HU8ekVAaJY9qCpO4yo3mvHkQXgELRKjk1iX8Qwf+bM9wtqyI1Z7IlfF6spY7NTWf7Osa hJHmNy7C4dFk/4RdzvGIkI+azQmlOfviSSkM0SFweTFy5zVLNYuCfwQOJaUIhyACle7X RQz8eiaVBfzJFpa6OBUcbU7+Yfc4YUhcMCicgAhmUERPLLePjqYzPa7gduVY40r0pfpW Xvix+iaYOqUDBktPjF3UiFZnnktx2fmp1zTSExBfzj+qbdSsDft5jAveUFcXpeAOt5Na poyA== X-Forwarded-Encrypted: i=1; AKwUvBzF/vXRnBfYCakMepYncDrtycuU71JS5/PZgTfHxMgZKHe/itiLAiztoSAmAlEO9lu2YMRQ235JLDU=@lists.xenproject.org X-Gm-Message-State: APuU4Z9wIleogyPatUKaimDV7oUeCU6+yZhkQo9rJCC3qw/fzBndqPtY i5YlfWklrqHHhr2oPUAW/n89xujVGZ/7yxXpQBKubBq0akKlhnTnezB61rISWFxtodc= X-Gm-Gg: AYBFou32PA4lUcFXoacoFiflm6jjJrCupNZxCY5E2TIOiISeNTpPQJOt/jmqnMkhdL7 u+7UqWHeWOflC2YhZhNOss/Yk32GjyOBtnbL1SFvcWzAyZ9uGiaTihulcibiocFoK9tY/TfKVR1 gkrwIaK5zN1/+x1bGL4rSNkkRg5SdICNikww6geOCXS1L+ZRQHjqv9EweB12ChQb8MoA8PGhCyF RmLQyYEJwRfeaESH3XrfAw4YPyBZhGLB/yWHixI3YdhlFzoKPdnk97wHgtBgERUtJUC6bqAmAn6 9Qu4ztKeYy0PwQAG1QQSp9UO2t1/lKe4TyhMR+Q3JJ5zzfEziPnpreJYM+ZNGx0KTPZ8tYPodSu 2R8lHAL1CROOCiZ+88X8UcxO//yw/SzP+CbeKYvSR7LYK9eUdiZnF12rT3aVbBllYdJR4gmhg1n qxsf1vuKnD7lHC2+d7x/wrMc0nmX/QeaDMW7FlHnZfuteTOw9novKXkuCZIMD+sqs4hVcIWXoqj RB292xYTE8//MnkOHwakGCW7GSfz7zSI4S7IAM1DBlJR+a88x2riv+8krzE+rKiAFl6U6j4a8Kv AXFKGxovTwx0qPJ4i03X5yuVGotJqgGYTsCKkSEH+Lsgmg== X-Received: by 2002:a05:6214:62b:b0:914:3120:b7c3 with SMTP id 6a1803df08f44-91e942fb275mr13978456d6.7.1793825278319; Wed, 04 Nov 2026 12:47:58 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:19 +0000 Subject: [PATCH net-next v4 07/15] net: skbuff: let skb_zerocopy() copy a short skb without head_frag MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-7-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825269; l=3270; i=josef@toxicpanda.com; h=from:subject:message-id; bh=313gSpe/OEgGmNrXVMk6Bxzm48vCKWeKxx/RzkLjq2I=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QHgvwpS66JnChP5h4nxV7iE4T6sQFYhC59dUOgap4jvS9EDZJ7F4fJ80RgGphM7ipwgq23QtCp8 fwTiLMJkDtAI= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-c201ff/1793825279-24F1F2A1-ACB7C31F/0/0 X-purgate-type: clean X-purgate-size: 3272 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825302898158500 skb_zerocopy() refuses an skb with no head_frag when the caller passes hlen =3D=3D 0, because it can't reference such a head as a page. That check sits ahead of the small-payload path, which copies everything with skb_copy_bits() and never references the head. Open vSwitch gets there with an ordinary request. OVS_PACKET_CMD_EXECUTE allocates the packet with a kmalloc'd head, a POP_ETH action on a 14 byte frame leaves it empty, and a USERSPACE action calls skb_zerocopy(user_skb, skb, 0, 0). The upcall fails, with a WARN on CONFIG_DEBUG_NET kernels. Before commit 433380f5ab8f ("net: skbuff: don't BUG() on a missing head_frag in skb_zerocopy()") it hit a BUG(). The request only needs CAP_NET_ADMIN in the user namespace that owns the network namespace. Move the check below the small-payload path and document the -EFAULT case. A genetlink reproducer run as an unprivileged user in its own namespaces warns before this patch and doesn't after it. The small-payload path hands @len to skb_put(), which panics on a negative value, and nothing runs ahead of it now. Reject a negative @len or @hlen on entry with -EINVAL. Neither caller passes one. Found by the Sashiko AI review of the BUG_ON() series. Fixes: 433380f5ab8f ("net: skbuff: don't BUG() on a missing head_frag in sk= b_zerocopy()") Fixes: af2806f8f90a ("net: Export skb_zerocopy() to zerocopy from one skb t= o another") Link: https://lore.kernel.org/all/179173804997.434549.4450793967361922984@k= ernel.org/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 96c8835a262b..fd4689cea94b 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -4072,8 +4072,10 @@ EXPORT_SYMBOL_GPL(skb_zerocopy_headlen); * Return value: * 0: everything is OK * -ENOMEM: couldn't orphan frags of @from due to lack of memory - * -EFAULT: skb_copy_bits() found some problem with skb geometry, or reada= ble head - * payload would be mixed with unreadable frags. + * -EFAULT: skb_copy_bits() found some problem with skb geometry, @from has + * no head_frag and @hlen is 0 while @len doesn't fit in @to's tailroom, + * or readable head payload would be mixed with unreadable frags. + * -EINVAL: @len or @hlen is negative */ int skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) @@ -4084,15 +4086,23 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *fr= om, int len, int hlen) struct page *page; unsigned int offset; =20 - if (unlikely(!from->head_frag && !hlen)) { + if (unlikely(len < 0 || hlen < 0)) { DEBUG_NET_WARN_ON_ONCE(1); - return -EFAULT; + return -EINVAL; } =20 /* dont bother with small payloads */ if (len <=3D skb_tailroom(to)) return skb_copy_bits(from, 0, skb_put(to, len), len); =20 + /* Without a head_frag the head can't be referenced as a page, so the + * caller has to ask for it to be copied. + */ + if (unlikely(!from->head_frag && !hlen)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EFAULT; + } + to->pp_recycle =3D from->pp_recycle; if (hlen) { ret =3D skb_copy_bits(from, 0, skb_put(to, hlen), hlen); --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825315; cv=none; d=zohomail.com; s=zohoarc; b=jss/2PALu00TxzneZ+IdjuXSo9QhgVwJ0FBBLoqyfLxSIXCBhyFMfZ5UW7h3BrKydmRhUT+C+glcGWCbjoG8ttQM+kxgHVrRvimvrtri2u7BJoJg9dyQcZc/oP1Fij3mNxi7VW7YS6/8cAV8/URAGgODbhOiG3aIEm4XHGHoXQM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825315; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=I0fgOhN7DOs5sphgS4nlyf+SCbWBYGAvkUGVDVkmjaU=; b=bbTOhblikxID6vREKc9r7d2S0aNnhZfxMUs0aATm7comwoSVXGmYXvAkOCgPEYAlJr71/hFdszXTVk06tCstMGVPutQOmbDuWSnYHa6Xij3aa5nt/pzFD/UBQ4aFJ0yAzGQb1K1YFN/qoP47/jY8a9iWpOEmnbV8nnTlYEw0GvY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 179382531545691.70018789732785; Wed, 4 Nov 2026 12:48:35 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472763.1680647 (Exim 4.92) (envelope-from ) id 1xOhtr-0004Sn-Ld; Wed, 04 Nov 2026 20:48:03 +0000 Received: by outflank-mailman (output) from mailman id 1472763.1680647; Wed, 04 Nov 2026 20:48:03 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtr-0004SC-E0; Wed, 04 Nov 2026 20:48:03 +0000 Received: by outflank-mailman (input) for mailman id 1472763; Wed, 04 Nov 2026 20:48:01 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtp-00043D-M4 for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:48:01 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtp-00BcE3-2b for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:48:01 +0100 Received: from [10.42.69.7] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99ea-e002-0a2a0a5209dd-0a2a4507c1e0-26 for ; Wed, 04 Nov 2026 21:48:01 +0100 Received: from [209.85.219.43] (helo=mail-qv1-f43.google.com) by tlsNG-ef75cf.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb9a00-b4ea-0a2a45070019-d155db2bb83b-3 for ; Wed, 04 Nov 2026 21:48:00 +0100 Received: by mail-qv1-f43.google.com with SMTP id 6a1803df08f44-91bb5795792so12669786d6.2 for ; Wed, 04 Nov 2026 12:48:00 -0800 (PST) Received: from toxicpanda.com ([153.61.196.255]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91e962b4403sm2743706d6.20.2026.11.04.12.47.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:47:58 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825279; x=1794430079; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=I0fgOhN7DOs5sphgS4nlyf+SCbWBYGAvkUGVDVkmjaU=; b=P8tOIqDwaUqwLbJ2UaNgF6Dcp9+03A/kyRo0thS6UWMn5A/cHsdYAkMlDtzo4C7E33 DMJ8Bb0hOkz2fHBSy+xLVpMOMVnkL+IOCdAs3yg0c/J8OJuZ6CksHyCGtg+VRAKsWr23 vVSwchGLyL14Cf/AkQO7LQVN1eo/XHYC6LWibUB47tssPKh/+Am22jj1fZ1zlLz8AtyS 9r1QafQxPfB+4ih3zHScmmrjwsyC8X+J7bubyu/FSAGH3+UNnPrWktnvcB1+UENaG3hX 6JEvgTs3dYsJ2uMFtNn3N9GnsitHyNvLyzSmzcUIs02arGMmjflQqIppNx2/XTqN6POD Oikw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825279; x=1794430079; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=I0fgOhN7DOs5sphgS4nlyf+SCbWBYGAvkUGVDVkmjaU=; b=IRqYaNztOkSmiS/qM0Qn27FOPTNVmmwHBKI1JSPXDLambcgsvQQ6l7JDu80ESY4rt6 bJqk3pH0Xi1ioxv8eKy53b7sP8QwsYvd13iqQkrc0lqH9jL9EtrM5eK3E7VgtAmYxJ3Y Jj5cPsKtDtuR9EKciV+8SUcVm9COD8Z2xyQcqG/nVpuOdYQL1FbDHuZ6AWWDSKysKfN1 7+FmtqcXzR5T9V+VW6/ozURUdsUUL4haFfRZHY1NQibJfLyNxegfsw6yOj7rZw4GAPdW 8o6IBpUOZSETM5bb1scy12fymCv9BOtO32JNTjjiPSbERz7wxBjgPoTB0ewCisfr0/WP 2SSQ== X-Forwarded-Encrypted: i=1; AKwUvBy2QCcd7MR9a6OjpG9FjpSxtgvPoAPHACP3Ofg1g/E15jmVzZHTu9Uq66zw/hMt39LGNMXzxjN3GF4=@lists.xenproject.org X-Gm-Message-State: APuU4Z84J5KeW8nUtP07N2GSPcZ7YukiMX6z8ZnTVreCs6r5MIhVLh9w 6b3zr9OIRuZq/C7FDUxXMki+tkHAP8CObib0/doKmjvbNRo6D09WIKiKIRYqu0zOdE4= X-Gm-Gg: AYBFou1pvxi3Q5J+PDS4gwBghjs0x3g2bnTv5tI0/q8fwcbTiTaDiDwFGKmOdej9Kuf c30YGxf/dlC48HBOzHQDNoIeb0ntYEUouZQjf2HGejUhXEtksjt4tmP+4k6qJmlhrK7PlX+zzDU FDi+lUywjBbTAk1+7SO23GtJuCCddUpYZd3xOy0jS+xaU2sBU0mH+mwkeo8F6idqtE6FjeyWhmJ 1dEAvAcQQTp5JATUmiW07DIRYd3P7hrTh7bM41rHWY1gjvdwoNy5vvxwc2FCvPH7kw/WJKXbGc3 94kiSkgG22O/0YNqtLNKn4EJXUjY8n4R89dHewIFOgSAUO4x0iq3hF+yrUr2/+lYJa/aQq4wIqw hGl49enGKzkqSk2q45gswr3qN96hcSFm/urhPTFz2n6/RaXuGGZ8dfu25kJk1pzffzf0+IkdeWt AHzHp2BlOw6PneY1O+EZ7v3sIPKv2uGOEdxBG39/uaOfeUIoHcWWW1nu7kBrGcQ/hWZwkQ7wmN7 inS9sGq2WD4YCrE9Rw0jiIimxaE0l/NdS+wHYiQhmcIgGbVCYrH5CBP/QHUVPs01fBxnCZctBZs IwV8xdo4P0qoWA2GnZNIp8MWdd9g9EnBgIp/A2M96E9Iwg== X-Received: by 2002:a05:6214:3017:b0:914:1807:dc70 with SMTP id 6a1803df08f44-91ca4adcf1emr285668046d6.13.1793825279344; Wed, 04 Nov 2026 12:47:59 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:20 +0000 Subject: [PATCH net-next v4 08/15] net: skbuff: make skb_try_coalesce()'s len unsigned MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-8-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825269; l=3910; i=josef@toxicpanda.com; h=from:subject:message-id; bh=1Fxify4JpxLzLM1Ti2e+64TfuNshdGdOIM7pownAVrU=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QHxEsFLzJgR3nlUT1UdgoB00cssfz8v87Mti65uiGcMrjonP4uPcKrvqTbz8Wc8/j5y224vXNuI 0BaUMX9dJ8Aw= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-ef75cf/1793825281-378D1AE4-4D669ED1/0/0 X-purgate-type: clean X-purgate-size: 3912 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825317167158500 skb_try_coalesce() keeps from->len, which is unsigned, in an int. A corrupt from->len above INT_MAX turns negative, gets past the len <=3D skb_tailroom(to) check, and reaches skb_copy_bits() as a negative length. skb_copy_bits() returns -EFAULT for most such skbs. If skb_headlen(from) is still a small positive value, skb_copy_bits() clamps the head copy to the negative length and memcpy() takes that as 2GB or more. skb_put() used to run before the copy, and its overflow check caught most of these lengths, but not the ones that wrap skb->tail back below skb->end. commit 279877d86c82 ("net: skbuff: don't BUG() when skb_copy_bits() fails in copy helpers") moved the copy ahead of skb_put(), which left only the tailroom check. Make len unsigned, like from->len, so that such an skb doesn't take the copy path. It gets to the truesize sanity check instead, which sees that from->len is more than from->truesize can hold. That check only warns, and only after the head of @from has been added to @to as a frag of that size. Make the check refuse the coalesce, and move it ahead of the head steal so that @to isn't touched. The check compares the int delta against len, so it now tests delta < 0 explicitly. An skb from a driver that under-reports truesize used to warn once and get coalesced. It isn't coalesced any more. A test module that coalesces an skb with a page frag head and a len of 0x80000010 gets false and an untouched @to. Found by the Sashiko AI review of the BUG_ON() series. Fixes: 279877d86c82 ("net: skbuff: don't BUG() when skb_copy_bits() fails i= n copy helpers") Fixes: bad43ca8325f ("net: introduce skb_try_coalesce()") Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f73289= 5b@toxicpanda.com/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index fd4689cea94b..2c246f563555 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -6480,7 +6480,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_b= uff *from, bool *fragstolen, int *delta_truesize) { struct skb_shared_info *to_shinfo, *from_shinfo; - int i, delta, len =3D from->len; + unsigned int len =3D from->len; + int i, delta; =20 *fragstolen =3D false; =20 @@ -6525,9 +6526,6 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_b= uff *from, return false; =20 if (skb_headlen(from) !=3D 0) { - struct page *page; - unsigned int offset; - if (to_shinfo->nr_frags + from_shinfo->nr_frags >=3D MAX_SKB_FRAGS) return false; @@ -6536,13 +6534,6 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_= buff *from, return false; =20 delta =3D from->truesize - SKB_DATA_ALIGN(sizeof(struct sk_buff)); - - page =3D virt_to_head_page(from->head); - offset =3D from->data - (unsigned char *)page_address(page); - - skb_fill_page_desc(to, to_shinfo->nr_frags, - page, offset, skb_headlen(from)); - *fragstolen =3D true; } else { if (to_shinfo->nr_frags + from_shinfo->nr_frags > MAX_SKB_FRAGS) @@ -6551,7 +6542,19 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_= buff *from, delta =3D from->truesize - SKB_TRUESIZE(skb_end_offset(from)); } =20 - WARN_ON_ONCE(delta < len); + /* @from claims more data than it has memory for. Leave @to alone. */ + if (WARN_ON_ONCE(delta < 0 || delta < len)) + return false; + + if (skb_headlen(from) !=3D 0) { + struct page *page =3D virt_to_head_page(from->head); + unsigned int offset; + + offset =3D from->data - (unsigned char *)page_address(page); + skb_fill_page_desc(to, to_shinfo->nr_frags, + page, offset, skb_headlen(from)); + *fragstolen =3D true; + } =20 memcpy(to_shinfo->frags + to_shinfo->nr_frags, from_shinfo->frags, --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825305; cv=none; d=zohomail.com; s=zohoarc; b=Mvp8puo4Ez2fXx7pDgwcDPi7F4oVCLXwtvV5qTq2d0qTLF2Z9jiWSY8xjuK2E1tAcPWgFvHcxOYWrzgFXc8oY6uwODyo2BDFkZJ4W+gSlXzv/aqH04j7JffBDLuYgpRViN/Rnw5nvsMrxK3r5KryQcxqmVntoJYPS/OE2pRIciQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825305; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=buSYjS3GdLDfaKyeptPicEQ91X+3t3GOSNONVwKle3Y=; b=k+8ttJJt1c5ozAVUFH0Mi5Kgksf/3XbcAJuXEDlF0jAcXa3dKf/y/0WdFZXVUg8GC0xwGudW5EIvQL2qBaO0nlJRejYO0yuEuVfS2Fvz6fB2d02/xL+JDnVh8N8nN7AbqZ4ie+V6ZLs5j+WTP+nxVrTrAkHNIfK+Xd2VsQzO5ls= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825305790594.5201651996301; Wed, 4 Nov 2026 12:48:25 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472764.1680654 (Exim 4.92) (envelope-from ) id 1xOhts-0004WF-9Z; Wed, 04 Nov 2026 20:48:04 +0000 Received: by outflank-mailman (output) from mailman id 1472764.1680654; Wed, 04 Nov 2026 20:48:04 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtr-0004Ux-RM; Wed, 04 Nov 2026 20:48:03 +0000 Received: by outflank-mailman (input) for mailman id 1472764; Wed, 04 Nov 2026 20:48:02 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtq-0004Fh-JS for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:48:02 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtp-000QZ3-W3 for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:48:02 +0100 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb9a01-8faa-0a2a0a5109dd-0a2a4501da4a-2 for ; Wed, 04 Nov 2026 21:48:01 +0100 Received: from [209.85.222.172] (helo=mail-qk1-f172.google.com) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb9a00-5984-0a2a45010019-d155deacb8de-3 for ; Wed, 04 Nov 2026 21:48:01 +0100 Received: by mail-qk1-f172.google.com with SMTP id af79cd13be357-93f3c89594cso103162685a.2 for ; Wed, 04 Nov 2026 12:48:01 -0800 (PST) Received: from toxicpanda.com ([153.61.196.244]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91e896f09e3sm18368646d6.25.2026.11.04.12.47.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:47:59 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825280; x=1794430080; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=buSYjS3GdLDfaKyeptPicEQ91X+3t3GOSNONVwKle3Y=; b=eAh3+POKqMbgGG9K6tJUxKyNBKudRiMj2B6eaFazBfD/f1XRoqb03wlFd+ic2dmVfP FGgA/iKfGmClQ7haNQTpDQUWq7AwVcI92GJY2PZ3C4K3qxh0GScPf3J5Ey6psUqhfnju WgMk1ZUND/yHXn99gufQgMr4RL66fjs2fC2Si+7aVXiLzCX8bzzUkAo+Mx2R3bslUnjj TpGZm3xmPTCaVysTLTuRur5egmN1YQAk6tuakt9ZCwsBGB7rL7AHURJX/qix0tjCXd4D ASbFtOWMUG9GmIM+aocTdX3c32O/x4HmyYC3NylbAhbBdgKZJ5kG2T89SR0UOXbgrNyI n6mA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825280; x=1794430080; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=buSYjS3GdLDfaKyeptPicEQ91X+3t3GOSNONVwKle3Y=; b=L9Nm0+tNK2jvNGGR8oM8lXf1QIvPmPf6gscpk/z0e90AIo0JB6fNesw4mYRT5UvqwA slkOmS//jTfe5C1+M3p0gBOAYpOX6TZnxxsVSgAgfxtQxUUXMzaV5wCyz1cdOdnaU50T CCQW8+nn8MsJZOi9Hy4qIyexNNgZxDFvLe/qXC9Kq2TJqvpQ9F+gd587E3wiCPcopZc8 vclj7Q+fh9sldMZW1CBcMBM5kDQ4s9YHeHF1k8KW/Se9qlEYYc3Z2WNLAVTu3Db6OEje s3r5rDePvvA1CBgLlnhUVxBF3gv81Jt9U66wbLF0+2OmC98MXX+fEm03y6ZwF5mGbaan RG2A== X-Forwarded-Encrypted: i=1; AKwUvBwW9vEwQ5BFvcH2FXnwiJVurMBFe7sEJAt6L4GY4eLAsvQX6jRCaPhBgwH+Mu2FdwEh3C+F4JkwVVY=@lists.xenproject.org X-Gm-Message-State: APuU4Z+Bh5u9CTwChiJxy/Celeo72XbVbhRsREfhpUEAVowd/GgOsSdp RZjZpbWSgMWNtGVkdHEpB8bXd5NY+RSkqmtsa+wAuAUn5KpIQbikLny4DnsP7wF2miQ= X-Gm-Gg: AYBFou0uYqqjahFySZCdfF270ORTFWSgiLtQ7P9jIL2CvVPbb0EFLrRkINxDSpmoDfz ffygUxOtH8YwpIblwiKhaojvvxFn5w3aYg/lcunJnhsiulJm03DaqXVyKMJaQZivSYmSWhGa64q EUnc9h++eIvIccLs4Jpo20yOQj1haf+YzhdtEUKY76HTovvbfJYIPnyZbXyt+VOUYQFV+ChZDGf e4r6m+ViaNjqs5AdQijtyzEB8dzNGqQi7Iqr550mXZdHlNVfeXmRqhc24FBXLmp44WUf2hzaBZq PhFtCGG5qR+5z5qSUAa2+TDZHN3TRcegL0vhAHJ4mchPwMctv/HXdNnAgE9BsQtUpmNfpSorYRu ZkfQRlc7qrE1z2J40xki7EFgtnnarXzSGZ8QNnhOuO0zAjjT9q2c8qmp3emL3UEfN8pyW4TjpXA WLvIPohqzmKtm1MqLFv+ooJoIbkxchb/+GT48Ylpe5xQg+8kKx7Rcan81eMfEVXz6VR06hoWuLV E/sviC1Pr68/y4DoADjA5E30de67gMOQRPDMMjEaa+mC22h+qqDNuN1oIbZ1+xrZ2ua2Y2G8sQf JDbC+rngy4mcb0bVm/u11XipVSWljsiSzgNcNYU1A0NlNg== X-Received: by 2002:a05:620a:3181:b0:944:907:8f64 with SMTP id af79cd13be357-9442174703bmr2898691085a.67.1793825280424; Wed, 04 Nov 2026 12:48:00 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:21 +0000 Subject: [PATCH net-next v4 09/15] net: skbuff: reject data_len > len in copy_and_csum_dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-9-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825269; l=1669; i=josef@toxicpanda.com; h=from:subject:message-id; bh=3g9gWyq3LNSnz8GQIQ6Nd2kWG1X8iSKYPw0MOlaABeg=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QKwOCX5WX+o2z0CP94Bi0sfWoF2Js1lcQMZ0CTKZpHu/4B9z0ISKOPPwpZOGdR/7NPil22GR5Na aLXWG/bs0rA4= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d62444/1793825281-BC75B757-09DC7915/0/0 X-purgate-type: clean X-purgate-size: 1671 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825306942158500 skb_headlen() is len - data_len in unsigned arithmetic, so it underflows to about 4GB for an skb whose data_len is bigger than its len. skb_copy_and_csum_dev() compares the checksum start against skb_headlen(), so its checks don't catch such an skb: - Without CHECKSUM_PARTIAL the checksum start is skb_headlen() itself. On 64-bit the 4GB value becomes the length of the linear copy. - With CHECKSUM_PARTIAL any checksum start below len passes, whatever the linear area really holds. The BUG_ON() that commit 56453199d28f ("net: skbuff: don't BUG() on a bad csum_start in skb_copy_and_csum_dev()") replaced compared against the same value, so this isn't new. No path is known to build such an skb. Check for data_len > len before anything uses skb_headlen(), and zero the frame. Link: https://lore.kernel.org/all/179273112823.3134.12241973533522574538@ke= rnel.org/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 2c246f563555..b017c9f861fe 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -4165,6 +4165,15 @@ void skb_copy_and_csum_dev(const struct sk_buff *skb= , u8 *to) __wsum csum; long csstart; =20 + /* skb_headlen() underflows if data_len is bigger than len, and then + * the checks below don't bound the copy from the linear area. + */ + if (unlikely(skb->data_len > skb->len)) { + DEBUG_NET_WARN_ON_ONCE(1); + memset(to, 0, skb->len); + return; + } + if (skb->ip_summed =3D=3D CHECKSUM_PARTIAL) csstart =3D skb_checksum_start_offset(skb); else --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825314; cv=none; d=zohomail.com; s=zohoarc; b=VGewFDs8LTXWaCyrhzfrE+d9NnohZmmWOuReq4wzciFFJiu6Ofo22AgOHaa0feUvFXhDSZJQV54cR2sZ6COCISJeGeWMNu8G3C1x2FjwG2unmPte+X927GayxSuQ8ge2sp/b6JLWBfy1WlmjBUyeF8Dp2waJ3iOzZQeZAsaS3+E= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825314; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=PP/fidHZYkfblatQP/IijP74GKPYKHpT3ch7DoXcS4E=; b=B3L/Sn1+4K9lWKIAML2rJFHFSJROC1A+9Pv40BIx25Cp+iuuZXPseZljwzwMImLuB19GiZcSmzm7lFI0O4EzY2zugynOzGnMGTKZH5UtRXLCPExwxi99qo0eGIuGfjy5mTtAYQ8FZROwiCyl1pVz8o5F9VjigiFC9yMu2ZeLQO0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825314014860.9512340663607; Wed, 4 Nov 2026 12:48:34 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472767.1680664 (Exim 4.92) (envelope-from ) id 1xOhtt-0004tM-M8; Wed, 04 Nov 2026 20:48:05 +0000 Received: by outflank-mailman (output) from mailman id 1472767.1680664; Wed, 04 Nov 2026 20:48:05 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtt-0004rq-C2; Wed, 04 Nov 2026 20:48:05 +0000 Received: by outflank-mailman (input) for mailman id 1472767; Wed, 04 Nov 2026 20:48:03 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtr-0004SD-Ko for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:48:03 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtr-00BcE3-0l for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:48:03 +0100 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb9a01-e002-0a2a0a5209dd-0a2a45038e4e-4 for ; Wed, 04 Nov 2026 21:48:03 +0100 Received: from [209.85.222.181] (helo=mail-qk1-f181.google.com) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb9a02-fae8-0a2a45030019-d155deb5c020-3 for ; Wed, 04 Nov 2026 21:48:02 +0100 Received: by mail-qk1-f181.google.com with SMTP id af79cd13be357-93f22a8515eso113948285a.2 for ; Wed, 04 Nov 2026 12:48:02 -0800 (PST) Received: from toxicpanda.com ([153.61.196.245]) by smtp.gmail.com with ESMTPSA id af79cd13be357-945d468f69asm294179385a.1.2026.11.04.12.48.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:48:01 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825281; x=1794430081; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PP/fidHZYkfblatQP/IijP74GKPYKHpT3ch7DoXcS4E=; b=MgCtR2BWB5A5mxpH0Rac4lDPz0ake9pFy6Z12iO5Gn8VXDX3AkYKAjt0i9xsrMF63c WZL5FLk1YG0mQRpXoxHFbYwW7A7jAdgkqNtrgal0iDYeVuZqyGV2snJKcL1gY0w0dQNY PSvwvM8SUv2lrT0F03uq3HDi1ZVjUbyjdLtfQbEj4eQfFApnvYY/iFrEnOQehIyBbh2Z ETU6FNay+PCrYZSD1N3C3Xm2BjwP+apRRn5wJJF3OSOPQpyBH6uoMlnvfIpLdUI4N4hN MuUNJie+rnr8s1V76i8wA+2rOJVZTb9PihRL3Ql4DSb+gy3qWPP/k/jpgizMzGplJbI5 2x8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825281; x=1794430081; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=PP/fidHZYkfblatQP/IijP74GKPYKHpT3ch7DoXcS4E=; b=18GrjvBDfUTfcl07XkrXIlffSwQra3GO9NQX3D5tC7JIPq+6AVJmHWNUa4sH8/jYQo uAimljbEPXzw+GVRz2JO3eQHh+B/m/jcZQMS/NeAoI5EhuCpJATGtpxixLzgPK2pLzot PhqGXxo1iuJ1q/Hj17Ntc7F/5zihPufaQsvnoJVk8hz4GAPRFGHbjt976JPTFLgAd3Gs eSN3MC+osy/fmHNwlIuXIrALj78aTj+AxiirEbZYP7/e60XBOFfP+Owbgkcc+9mzhvMe YzIWi3KK4XjbpWZqk0sbpMsD1rgs4TMdeDc13uW6bPjX92B2/W1vR4byYCZNS6KVaDHi nofg== X-Forwarded-Encrypted: i=1; AKwUvBxTsFH3SJoA3A00st0R1fOfsb0ng/ji3mPS74JVOX7vF6hmL74xIKmGKw2z8h7en44ggLKWopfq9Zc=@lists.xenproject.org X-Gm-Message-State: APuU4Z9djqmlQyqgS9uj5WvovG0TorO48618VrnCKfxqyKFCvU48T9S9 IykcD8JG2fA6qkMgP6SOchk6cqab7RsV8C7W3G2gdgNktHMzWzj81P4F98IAbPSkH2Y= X-Gm-Gg: AYBFou3zTOlj/fc6LJR959ij08vpye697VnRfx1Ql5LucPFM9A8EiLQXRsXvhn626ad dtxWuzfAn7B6YgzJcLlRgoRLv+Ta5iyZ1EUf6eKhlZzeOhv6vtlV0/Yz8aB6EPydN9Dk72uGGlZ KlWt8fov7wH1ZDDj21sJ0azQODj5KlA8GIBG1JkNergeUKPVRiUNITN1Pv9DCS80Q54AKhu8nuz SRIttgLYiQ2JQV+N03e9U6SXsyMB2xTE26V4mn6DmJZJLiLgOKHbM0jYUVDIl5GICjcyXdJD/t1 kvVrs8jAOt9KCVdEcLcHwJOQBX0bWg0Q+hi01GfeQyZaDybHFStjlZaMlUwccyu5fJqX8BC5oRP +f09SUxzFKXKkSZt6l8Yrc8Qi1yao2WsXlz4r+pvV6Ou2tyJo4eoLoA5LWzGoVTwf+J7MXKKylk ZMA+W7BZS9M31RTkQmO48JSkYNzydRIfiJMltNk8jIARBzsakWxG4eNOx3HtIBVrbB62FhdFFCr j1bS62IpJKuTpR72RbembtsfTuT/q0G2bceONAePM5baS2yrM/xag+jnSe6BbyEiuqXyFDoNCYZ CXBBpL0Wt490VdUCClsWgwrxJnhtjDkjEgY1f/5fBs2ukg== X-Received: by 2002:a05:620a:2b8b:b0:93f:2941:6b8d with SMTP id af79cd13be357-94421581808mr2833471185a.6.1793825281522; Wed, 04 Nov 2026 12:48:01 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:22 +0000 Subject: [PATCH net-next v4 10/15] net: skbuff: reject a negative length in skb_copy_and_csum_bits() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-10-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825269; l=2784; i=josef@toxicpanda.com; h=from:subject:message-id; bh=wThWIHnCxUs0o2n1wKVOZp8MJH+DkfwjLDuEZ2TxA3k=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QFsB+WUd2uViaXOb0v3E8Fyx/YypTY3hkcuEnhwIIaLSj1kGnyibicHErE4iRl1Wqf0Tvo/bwuX fykUuqyoPQgk= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-33051d/1793825282-6F8C54E9-A1D9DCAF/0/0 X-purgate-type: clean X-purgate-size: 2786 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825315113158500 The head, frag and frag_list copies in skb_copy_and_csum_bits() each clamp their length to @len. A negative @len from a broken caller therefore becomes the copy length, and the copy takes it as a huge unsigned value. The two len > 0 tests around the zero-fills only protect the zero-fills. Reject a negative @len on entry with -EINVAL and drop the two tests. @to isn't touched in that case. Every caller already handles an error, and skb_copy_and_csum_dev() zeroes its whole frame on one. No caller is known to pass a negative length. Found by the Sashiko AI review of the BUG_ON() series. Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f73289= 5b@toxicpanda.com/ Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index b017c9f861fe..7ecf6701f68c 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3731,8 +3731,7 @@ static noinline int skb_copy_and_csum_frag_list(const= struct sk_buff *skb, if (unlikely(len)) { DEBUG_NET_WARN_ON_ONCE(1); /* Don't hand the caller a buffer with stale bytes in it. */ - if (len > 0) - memset(to, 0, len); + memset(to, 0, len); return -EFAULT; } out: @@ -3748,9 +3747,10 @@ static noinline int skb_copy_and_csum_frag_list(cons= t struct sk_buff *skb, * @len: number of bytes to copy * @csump: where to store the checksum of the copied bytes * - * Return: 0 on success, or -EFAULT if @skb has unreadable frags or runs - * out before @len does. On failure *@csump is not set and the part of - * @to that couldn't be filled is zeroed. + * Return: 0 on success, -EINVAL if @len is negative, or -EFAULT if @skb + * has unreadable frags or runs out before @len does. On failure *@csump + * is not set. On -EFAULT the part of @to that couldn't be filled is + * zeroed, and on -EINVAL @to is not touched. */ int skb_copy_and_csum_bits(const struct sk_buff *skb, int offset, u8 *to, int len, __wsum *csump) @@ -3760,6 +3760,14 @@ int skb_copy_and_csum_bits(const struct sk_buff *skb= , int offset, int pos =3D 0; __wsum csum =3D 0; =20 + /* Everything below clamps its copy to @len, so a negative one would + * turn into a huge copy. + */ + if (unlikely(len < 0)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } + /* Copy header. */ if (copy > 0) { if (copy > len) @@ -3775,8 +3783,7 @@ int skb_copy_and_csum_bits(const struct sk_buff *skb,= int offset, =20 if (!skb_frags_readable(skb)) { /* Don't hand the caller a buffer with stale bytes in it. */ - if (len > 0) - memset(to, 0, len); + memset(to, 0, len); return -EFAULT; } =20 --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825305; cv=none; d=zohomail.com; s=zohoarc; b=Trm4HGcwFpj8SckuGPG4HY/IYo6okTHjSdDdVVwc7DGYzKv+tAbkVWHV4VKYJk9f8RQta/9mEkrWTWCQjpbJr72UfOrnu8NLuqf6YydhRnoIHeF5VIwbmugifCELN0/nJA5wrxh3JmAzRRjPYGZFn3UUNwZdM8kK9YS+HiMHMEw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825305; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=21AXhK/7pbqORDSG4HxUO46u8d65H6wDFEiP5u1gVuA=; b=DYFi+nAWdGvVDKkg/wYiRoM4ArEZHgTBt3fI6whRZA5449TOZau1b7oHizUu+4gE1tnEZT8dckXDuoLNFE61SQxFPDMYD8Uz8u67N+RdkkPnpqSln3HzKQbI4c6tG6iFlcyMPUwypBEnl/JPz4tKP8XbmZ0d/iO/u+6nddGJZts= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825305665643.6227670930757; Wed, 4 Nov 2026 12:48:25 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472768.1680669 (Exim 4.92) (envelope-from ) id 1xOhtu-00055O-SE; Wed, 04 Nov 2026 20:48:06 +0000 Received: by outflank-mailman (output) from mailman id 1472768.1680669; Wed, 04 Nov 2026 20:48:06 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtu-00053l-DU; Wed, 04 Nov 2026 20:48:06 +0000 Received: by outflank-mailman (input) for mailman id 1472768; Wed, 04 Nov 2026 20:48:04 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhts-0004fo-OM for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:48:04 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhts-00BcE3-57 for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:48:04 +0100 Received: from [10.42.69.3] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb9a01-e002-0a2a0a5209dd-0a2a45038e4e-6 for ; Wed, 04 Nov 2026 21:48:04 +0100 Received: from [209.85.222.173] (helo=mail-qk1-f173.google.com) by tlsNG-33051d.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb9a03-fae8-0a2a45030019-d155deadf066-3 for ; Wed, 04 Nov 2026 21:48:03 +0100 Received: by mail-qk1-f173.google.com with SMTP id af79cd13be357-93f1e5d7450so114462485a.2 for ; Wed, 04 Nov 2026 12:48:03 -0800 (PST) Received: from toxicpanda.com ([153.61.196.255]) by smtp.gmail.com with ESMTPSA id af79cd13be357-945d4813a6fsm293565585a.21.2026.11.04.12.48.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:48:02 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825283; x=1794430083; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=21AXhK/7pbqORDSG4HxUO46u8d65H6wDFEiP5u1gVuA=; b=cwTvmlVeJo7m10G+m/hC028Nv+UHHlAwFIcnzpGu7Ocgxd58Q+XEMncQEi/hP41gIe EVst13OdDfzMyft9iU88+Wc1999LTzUj64gWNjt4jZXHO3ITGNrVn2Y0Ubx8gdxMNm8B 2+59dmoq2+ycltNdM5v7kyZjXBu08jkNHFyHby8Jh9LGX9imsh2irBfJeNYjv2hPd4tZ RkJH7tdSmfVmmz91kjxjKUQeCij+dG+7Lp4GhKq9hcguvNLx2i74sqWyPfD3QyF6Jwik V8l+6NgEYA5fckRGLeGNlpkydyoTm2hv2bu2qsdAlZ1iWmW9lYte2kXpbeicuhgKCXk6 NSkQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825283; x=1794430083; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=21AXhK/7pbqORDSG4HxUO46u8d65H6wDFEiP5u1gVuA=; b=0vTs+UTcoG1IJ4+nPrUAf7qc37M5VKWjLLTLMCQ+gKCfkeSnXyPhIITnexnsTCdrHC aCxkFx4pf7nueLlOaKUK3WfW4+49eTURjc0aFDfZOARZnH9gxu7zodHsYl4MuYv4AglM m6u5NQ/h4gsESobMZlGKrADOXaekhS0Ic0wKrOXQxqD1yH1i2vIfDu6+tNJT4UWgCbSz iIxMJf0x5FEQM3X04qFMYmjqxENEGaP/ybRJbf8hi0wfAh39RMeB3NAxl+sE+l7Z7xu4 7kcnc/5MYWO7JyubrDatAoem03LOFy8RHCXRMhG26DUAnje9QCXQK9flF8bNPn6ot/WD IsnQ== X-Forwarded-Encrypted: i=1; AKwUvBwLlAHd2+kQQOpSG5dF1uk3P8SO9JFx5NVat7AqllN+B+Q7Mp8hdiRz/LRunUUhUextWaWdR+aqaw4=@lists.xenproject.org X-Gm-Message-State: APuU4Z+jlR23cH1OPKgqdU56NoCkrEQ4i/2JOEEvOKwxxv0ly7idruHu KOz9QOcNHgFsoen/xvmy5bC6r2uUm1Xcfe/SFxyeTj+BBSTnvZWOWU9gF73D6CCIfpM= X-Gm-Gg: AYBFou0gPlBgvk8b/30N3KDphVlRDgn6u7A1ycis6GOMFCydCI9yJT4IwFxpuDq5WSP 4dWhV5A+sKNvozWUgeyaO1bQR1oah3F+tBBDuN4LiMk/nxXmEb8NNYr70DoVzlU3Df97mLzd0L6 ZpTMUc/tlhv5DSrUQHdLyYoX4j6Pm3bpGUY04Q6jMYhCxmVAiTHJ1VioCUS9DP/5iUr9FAZqho/ tjaOk0F3MqOC0/Zv74ux7gAg5M45ut26g88ADDL3Y4Qs74JlwLpwzSy/8wuHo8YussCV8OBCSlw 7Ru3HcATN0JDKDbBtzKsL2dcs+GWdi4kspAziWHfP8M08Ni6TUs21LjDZHsxc0jBOfTqczf7J08 kfUsGCw8QiQITCxho2pZy95Z0ddVgn+k9PHDcJS3gxwUFRBTec+4SteMEChD8HBi4d0dU1y/xeS 4aFfH1fbqxh9y1uKT20EnnoBIC17PCMkcAS1kOXiBXR1zBW/4vNw1Bm9c/qtgVgI1NZ37joWQOv +7rQY14ulkJMjRz+DaT3G7OuqNVp65Nx7jbWr7AUKVKVlLdthUjrA3egDigtIKAjuuq/l6w0U40 NMkzmXscZp9QmKEY3RaFYqLaLiwqKFCPlr3xSAJSmZYOFQ== X-Received: by 2002:a05:620a:2984:b0:93f:2e7e:c818 with SMTP id af79cd13be357-94421799c57mr3047302585a.59.1793825282649; Wed, 04 Nov 2026 12:48:02 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:23 +0000 Subject: [PATCH net-next v4 11/15] net: skbuff: don't run off frag_list in skb_segment() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-11-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Willem de Bruijn , Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825269; l=3248; i=josef@toxicpanda.com; h=from:subject:message-id; bh=6s0PzVt82/I3gWDSKQnU5ZDEZJBYWsfTYigRyKi8yTo=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QBVz2JFcgnUXu6h2/lcBh0xilKeArmwQIEfFWo4537wo7SLcPc1F7X+FqiGAn38PBEs5QZhYRtT GHOVrXmke0Qc= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-33051d/1793825284-6D8D54E9-96F4567D/0/0 X-purgate-type: clean X-purgate-size: 3250 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825306969158501 skb_segment() keeps going until it has segmented head_skb->len bytes. It takes the data from head_skb and then from each member of the frag_list. If head_skb->len counts data that this walk can't find, the walk runs out of members while it still owes data and dereferences a NULL list_skb. There are two ways to get there: - head_skb->len is bigger than what head_skb and its frag_list hold. - A member has a frag_list of its own. head_skb->len counts those bytes, but for each member the walk only looks at the linear part and frags[]. No path in the tree is known to build a GSO skb like either. GRO flushes instead of chaining an skb that already has a frag_list. IP reassembly does nest frag_lists, but a reassembled skb isn't GSO. Check list_skb in the three places where the walk moves on to it, and fail the segmentation with -EINVAL. The KUnit cases in the next patch hit the NULL pointer dereference without this patch, and at least one of them hits it again with any one of the three checks taken out. Turning SG off doesn't avoid it. The walk reads list_skb to decide whether to clone the next member before it looks at SG. With the checks in place the payload is copied by skb_copy_bits(), which checks the length itself and recurses into a nested frag_list. So without SG a len that is too big fails in the copy, and a nested frag_list is segmented. Found by the Sashiko AI review of the BUG_ON() series. Link: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f73289= 5b@toxicpanda.com/ Reviewed-by: Willem de Bruijn Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/skbuff.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 7ecf6701f68c..45cd77e153f1 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5164,7 +5164,16 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, int hsize; int size; =20 + /* list_skb runs out early if head_skb->len counts data that + * this walk can't find: bytes that aren't there, or a member's + * own frag_list, which the walk never looks inside. + */ if (unlikely(gso_by_frags)) { + if (unlikely(!list_skb)) { + DEBUG_NET_WARN_ON_ONCE(1); + err =3D -EINVAL; + goto err; + } len =3D list_skb->len; } else { len =3D head_skb->len - offset; @@ -5174,7 +5183,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, =20 hsize =3D skb_headlen(head_skb) - offset; =20 - if (hsize <=3D 0 && i >=3D nfrags && skb_headlen(list_skb) && + if (hsize <=3D 0 && i >=3D nfrags && list_skb && + skb_headlen(list_skb) && (skb_headlen(list_skb) =3D=3D len || sg)) { if (unlikely(skb_headlen(list_skb) > len)) { DEBUG_NET_WARN_ON_ONCE(1); @@ -5296,6 +5306,12 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, =20 while (pos < offset + len) { if (i >=3D nfrags) { + if (unlikely(!list_skb)) { + DEBUG_NET_WARN_ON_ONCE(1); + err =3D -EINVAL; + goto err; + } + if (skb_shinfo(nskb)->nr_frags && nskb->pp_recycle !=3D list_skb->pp_recycle) { nskb->data_len =3D pos - offset - hsize; --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825320; cv=none; d=zohomail.com; s=zohoarc; b=RzKWw+jgkg7NBt4QyY1ePEBRx5iYvqmpRwxYVkjjPpbmGX0RaavtWtlUgtjH0QShO8/2+X79TJob9sle9e0jAT95eMr9oeMcyYWdEYIGpaz8QqHe1ZmbUS5LwpTv7HzMoUwxIXqi5v+2mbVuiYObI1Je3MKIhX+gDHqcqSPAiic= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825320; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=p0RXmawfasrTX5jMs9+VRHea8GI7D/GAkKgJQ1fq4BU=; b=G80yRED2T16ePMyDnISpDiEKcKldSntjKowE7bfzmrEUBuK4TCXid0pvIYHxQA5C38cNBUTfZNXMomABPQfIl2MZQwu29/PuZF6PQC8jHdM5ni4qbm6Of4UgpXMFxrAqfn0DXr7sJhivXGiCAWNRPydwXULfm3mvwnNRb/vAXFY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 179382532032888.72797044545712; Wed, 4 Nov 2026 12:48:40 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472773.1680680 (Exim 4.92) (envelope-from ) id 1xOhtw-0005UR-JU; Wed, 04 Nov 2026 20:48:08 +0000 Received: by outflank-mailman (output) from mailman id 1472773.1680680; Wed, 04 Nov 2026 20:48:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtw-0005Se-8b; Wed, 04 Nov 2026 20:48:08 +0000 Received: by outflank-mailman (input) for mailman id 1472773; Wed, 04 Nov 2026 20:48:06 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtu-0004yP-4k for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:48:06 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtt-000QZ3-Hi for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:48:05 +0100 Received: from [10.42.69.9] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99bc-8faa-0a2a0a5109dd-0a2a4509d8b0-24 for ; Wed, 04 Nov 2026 21:48:05 +0100 Received: from [209.85.219.52] (helo=mail-qv1-f52.google.com) by tlsNG-bad1c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb9a04-be1a-0a2a45090019-d155db34bd32-3 for ; Wed, 04 Nov 2026 21:48:05 +0100 Received: by mail-qv1-f52.google.com with SMTP id 6a1803df08f44-91c63449320so12032306d6.1 for ; Wed, 04 Nov 2026 12:48:05 -0800 (PST) Received: from toxicpanda.com ([153.61.196.244]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-91e962b4403sm2745066d6.20.2026.11.04.12.48.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:48:03 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825284; x=1794430084; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=p0RXmawfasrTX5jMs9+VRHea8GI7D/GAkKgJQ1fq4BU=; b=ppjf1vB1A1Rbr+usYZ23bnfAuHlp50cZb8tDDi6Juuvqp5WunItAP9Uskpj0fQ4Yo9 me+5+Fglu7FvBtmZPRP1kRvGcbUq7mR6csA053v1NAsZ2hyzdRzBgkJOn4jYlsqEBfiS pJmJl1PL8N+6QdRAA14cEVKXz1I7theCqtA09sbHlcgDAXugcHe4fQ4vT5rWKLtCtNHa HgVY3WRHy8rveAytG6uIhBAU2znn/KNMvyhIYC+XYjl41B1iEFpQG3AXcSNyxPjkB70p BJb+JdEPo7FM2w/i0bhx3WwUBrfT/v3+8aJAF8Cs6UP+9ISnkuGSb4Sw34PCyFTAdA7J QC8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825284; x=1794430084; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=p0RXmawfasrTX5jMs9+VRHea8GI7D/GAkKgJQ1fq4BU=; b=huPtoLPM4EkChk+nlHTQCFpcyl7Qj/zLVuGlh59hmQKQWSt5QCqwyaNY+ZBvd6IOzx Uz3YJfdrgy1WQwnI/7LqT7D3uhFYFAQME20uqwNjcBR80HLc6bJJTEw42REZ8TJMen7D ge0H95FXNWEW7lF/fX2TrySC/q9vWJiwL14gFGLLfGAdC+HwYlPsSKENCnpSa+VDXpBH Z9AKUf0dBbDWGQvRa+49bbB3weClLQJzrDcPTaMpF0CX5kMNHq7Qom7aT4Eh38QauOjF opm9/nZK1NiDnM04hHFi9m+UiSz5WmfIvpCKWt7BGuUttagS4LiYnYgMrSAEFnBurJQm frqA== X-Forwarded-Encrypted: i=1; AKwUvBzQPAGaA8ipWphUfB9+uvvuVbSkujAjW9/T6WCTBuj/Wu48wtGLwnJkN8tCUzuZHjqAaAOafou8MQs=@lists.xenproject.org X-Gm-Message-State: APuU4Z/GfD5tiec790ui+JaeOIGe3wv4QUrOJ2ZcV6x7Iqqk6tcMVSwa uO2Xr8ASs0Z/yxJfj7WG6wewi2N1syEQV9JxkUsiMU74MUwm4a5RV5By4e0wkIzQcfk= X-Gm-Gg: AYBFou3J9weMItWIfcqh6kyzXyBMHP2+fmfj++exWLVMsMb8kgZfQJtK+XzESRjQM8d FsvZnNiq1WEAXvXHYDpQ5t5A/AhTeVFN/slqfoVQslQNAzOoIc4Lmm2AlaWj6sX7mYrygzszlqC FgDAFLZhV9OQg/cmwWZ7QXgTb4oL6AUdgcb/aVMsy2B4vWaDAJhudjlDCnjr7iB+SD0PgMiCNkW w5Iz9iRdtWhIOBW/Trb5HtEbnSf54dTVSQCW4Zo5Hivi0r395zHcLQ9gB/2GQ146zFBDRqb6t71 reBpGnLqWWkBc+X6PFvNp/PTBZDxpZTYu4WDfEtqv3h08f7/ZiQ7/FKHX9WTGf5F6CyDn/6/xCR 6jss5gaLIKSI0eNwkZj9v7bkOnpcAGlGrw7pff2W97fvC7i9mB22kWBk0kszWhKJzcV+jeGJgTq VezLFrIPOe5NXGUjmjoV7HS/kStap1IJhh8mgj/ZwvUfkw5NCkWjacq0vkbfF80MxnnYBL0SIPT j76GcslGc1Q4ZRkcHqTlmKVPBH4GuevjTakyDFnaj2K5VuauZIRfj0Ve+o8yf5zwwgEbTctcER6 5CtyRYjtKaN2bVF9KnfYEUFGct99J23P+ldQT3hW4s2rIA== X-Received: by 2002:ad4:5ae6:0:b0:91e:93df:7968 with SMTP id 6a1803df08f44-91e93df8690mr14233906d6.58.1793825283878; Wed, 04 Nov 2026 12:48:03 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:24 +0000 Subject: [PATCH net-next v4 12/15] net: test the skb layouts skb_segment() refuses MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-12-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Willem de Bruijn , Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825269; l=7318; i=josef@toxicpanda.com; h=from:subject:message-id; bh=7eIKfmXdYFyO4gt39hdEL3I6I1+zpcaXVGaqmsE4mDU=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QER7Iemt/O5h6axALU8K/KXqZQqDuQVWaPwTSf9id6brnuO7euiqtgPfKirDjVhsD76QG+PWs0G ladydqEnuSgU= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-bad1c0/1793825285-BCCCF034-E3F1425D/0/0 X-purgate-type: clean X-purgate-size: 7320 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825321321158500 The GSO KUnit test only checks layouts skb_segment() can segment. Add the ones it has to refuse: - The non-uniform frag_list with SG on, which used to hit the BUG_ON(i >=3D nfrags) the existing test steps around. - A frag_list member that has its own frag_list. - An skb whose len counts bytes it doesn't hold. The data runs out on a segment boundary, in the middle of a segment, after the last frag_list member, and with GSO_BY_FRAGS. Run the last two groups without SG as well. There the nested frag_list is segmented. A len that is too big fails with -EFAULT from skb_copy_bits(), except with GSO_BY_FRAGS, which still gets -EINVAL. They warn on CONFIG_DEBUG_NET kernels, so run them with the warning backtrace suppressed. Also update the comment on the non-uniform case, which still says SG would hit that BUG_ON(). Reviewed-by: Willem de Bruijn Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/net_test.c | 158 ++++++++++++++++++++++++++++++++++++++++++++++++= ++-- 1 file changed, 154 insertions(+), 4 deletions(-) diff --git a/net/core/net_test.c b/net/core/net_test.c index 2b5080c22663..03203454cd19 100644 --- a/net/core/net_test.c +++ b/net/core/net_test.c @@ -41,6 +41,17 @@ enum gso_test_nr { GSO_TEST_RESEGMENT_MULTI, GSO_TEST_RESEGMENT_TAIL, GSO_TEST_RESEGMENT_ONE_MSS, + GSO_TEST_FRAG_LIST_NON_UNIFORM_SG, + GSO_TEST_FRAG_LIST_NESTED, + GSO_TEST_SHORT_LINEAR, + GSO_TEST_SHORT_LINEAR_STRADDLE, + GSO_TEST_SHORT_FRAG_LIST, + GSO_TEST_SHORT_GSO_BY_FRAGS, + GSO_TEST_FRAG_LIST_NESTED_NO_SG, + GSO_TEST_SHORT_LINEAR_NO_SG, + GSO_TEST_SHORT_LINEAR_STRADDLE_NO_SG, + GSO_TEST_SHORT_FRAG_LIST_NO_SG, + GSO_TEST_SHORT_GSO_BY_FRAGS_NO_SG, }; =20 struct gso_test_case { @@ -58,11 +69,18 @@ struct gso_test_case { unsigned int gso_type; /* skbs from alloc_skb() instead of build_skb(), head_frag clear */ bool no_head_frag; + /* bytes that skb->len counts but the skb doesn't hold */ + unsigned int missing_len; + /* segment without NETIF_F_SG */ + bool no_sg; =20 /* output as expected */ unsigned int nr_segs; const unsigned int *segs; const unsigned int *gso_segs; + + /* skb_segment() is expected to fail with this error */ + int err; }; =20 static struct gso_test_case cases[] =3D { @@ -241,6 +259,110 @@ static struct gso_test_case cases[] =3D { }, .gso_segs =3D (const unsigned int[]) { 0, 0, 0, 0 }, }, + { + /* frag_list members that don't end on gso_size boundaries + * can't be segmented with SG + */ + .id =3D GSO_TEST_FRAG_LIST_NON_UNIFORM_SG, + .name =3D "frag_list_non_uniform_sg", + .linear_len =3D GSO_TEST_SIZE, + .nr_frag_skbs =3D 4, + .frag_skbs =3D (const unsigned int[]) { GSO_TEST_SIZE, 1, GSO_TEST_SIZE,= 2 }, + .err =3D -EINVAL, + }, + { + /* the second frag_list member hangs off the first one's + * frag_list instead of off the head's + */ + .id =3D GSO_TEST_FRAG_LIST_NESTED, + .name =3D "frag_list_nested", + .linear_len =3D GSO_TEST_SIZE, + .nr_frag_skbs =3D 2, + .frag_skbs =3D (const unsigned int[]) { GSO_TEST_SIZE, GSO_TEST_SIZE }, + .err =3D -EINVAL, + }, + { + /* the data runs out on a segment boundary */ + .id =3D GSO_TEST_SHORT_LINEAR, + .name =3D "short_linear", + .linear_len =3D GSO_TEST_SIZE, + .missing_len =3D 50, + .err =3D -EINVAL, + }, + { + /* the data runs out in the middle of a segment */ + .id =3D GSO_TEST_SHORT_LINEAR_STRADDLE, + .name =3D "short_linear_straddle", + .linear_len =3D GSO_TEST_SIZE + 500, + .missing_len =3D 700, + .err =3D -EINVAL, + }, + { + .id =3D GSO_TEST_SHORT_FRAG_LIST, + .name =3D "short_frag_list", + .linear_len =3D GSO_TEST_SIZE, + .nr_frag_skbs =3D 1, + .frag_skbs =3D (const unsigned int[]) { GSO_TEST_SIZE }, + .missing_len =3D 50, + .err =3D -EINVAL, + }, + { + .id =3D GSO_TEST_SHORT_GSO_BY_FRAGS, + .name =3D "short_gso_by_frags", + .nr_frag_skbs =3D 2, + .frag_skbs =3D (const unsigned int[]) { 100, 200 }, + .missing_len =3D 50, + .err =3D -EINVAL, + }, + { + /* without SG the nested data is copied by skb_copy_bits(), + * which does look inside a member's own frag_list + */ + .id =3D GSO_TEST_FRAG_LIST_NESTED_NO_SG, + .name =3D "frag_list_nested_no_sg", + .linear_len =3D GSO_TEST_SIZE, + .nr_frag_skbs =3D 2, + .frag_skbs =3D (const unsigned int[]) { GSO_TEST_SIZE, GSO_TEST_SIZE }, + .no_sg =3D true, + .nr_segs =3D 3, + .segs =3D (const unsigned int[]) { GSO_TEST_SIZE, GSO_TEST_SIZE, GSO_TES= T_SIZE }, + }, + { + /* without SG it is skb_copy_bits() that runs out of data */ + .id =3D GSO_TEST_SHORT_LINEAR_NO_SG, + .name =3D "short_linear_no_sg", + .linear_len =3D GSO_TEST_SIZE, + .missing_len =3D 50, + .no_sg =3D true, + .err =3D -EFAULT, + }, + { + .id =3D GSO_TEST_SHORT_LINEAR_STRADDLE_NO_SG, + .name =3D "short_linear_straddle_no_sg", + .linear_len =3D GSO_TEST_SIZE + 500, + .missing_len =3D 700, + .no_sg =3D true, + .err =3D -EFAULT, + }, + { + .id =3D GSO_TEST_SHORT_FRAG_LIST_NO_SG, + .name =3D "short_frag_list_no_sg", + .linear_len =3D GSO_TEST_SIZE, + .nr_frag_skbs =3D 1, + .frag_skbs =3D (const unsigned int[]) { GSO_TEST_SIZE }, + .missing_len =3D 50, + .no_sg =3D true, + .err =3D -EFAULT, + }, + { + .id =3D GSO_TEST_SHORT_GSO_BY_FRAGS_NO_SG, + .name =3D "short_gso_by_frags_no_sg", + .nr_frag_skbs =3D 2, + .frag_skbs =3D (const unsigned int[]) { 100, 200 }, + .missing_len =3D 50, + .no_sg =3D true, + .err =3D -EINVAL, + }, }; =20 static void gso_test_case_to_desc(struct gso_test_case *t, char *desc) @@ -337,21 +459,49 @@ static void gso_test_func(struct kunit *test) skb->data_len +=3D total_size; skb->truesize +=3D total_true_size; =20 - if (tcase->id =3D=3D GSO_TEST_GSO_BY_FRAGS) + if (tcase->id =3D=3D GSO_TEST_GSO_BY_FRAGS || + tcase->id =3D=3D GSO_TEST_SHORT_GSO_BY_FRAGS || + tcase->id =3D=3D GSO_TEST_SHORT_GSO_BY_FRAGS_NO_SG) skb_shinfo(skb)->gso_size =3D GSO_BY_FRAGS; + + if (tcase->id =3D=3D GSO_TEST_FRAG_LIST_NESTED || + tcase->id =3D=3D GSO_TEST_FRAG_LIST_NESTED_NO_SG) { + struct sk_buff *first =3D skb_shinfo(skb)->frag_list; + + skb_shinfo(first)->frag_list =3D first->next; + first->next =3D NULL; + first->len +=3D tcase->frag_skbs[1]; + first->data_len +=3D tcase->frag_skbs[1]; + } } =20 + skb->len +=3D tcase->missing_len; + skb->data_len +=3D tcase->missing_len; + features =3D NETIF_F_SG | NETIF_F_HW_CSUM; if (tcase->id =3D=3D GSO_TEST_GSO_PARTIAL) features |=3D NETIF_F_GSO_PARTIAL; =20 - /* TODO: this should also work with SG, - * rather than hit BUG_ON(i >=3D nfrags) + /* TODO: this should also work with SG, rather than fail the + * i >=3D nfrags check in skb_segment() */ - if (tcase->id =3D=3D GSO_TEST_FRAG_LIST_NON_UNIFORM) + if (tcase->id =3D=3D GSO_TEST_FRAG_LIST_NON_UNIFORM || tcase->no_sg) features &=3D ~NETIF_F_SG; =20 SKB_GSO_CB(skb)->max_segs =3D tcase->max_segs; + + if (tcase->err) { + /* the suppression block doesn't run if it can't be set up */ + segs =3D NULL; + kunit_warning_suppress(test) { + segs =3D skb_segment(skb, features); + } + KUNIT_EXPECT_EQ(test, PTR_ERR_OR_ZERO(segs), tcase->err); + if (!IS_ERR_OR_NULL(segs)) + kfree_skb_list(segs); + goto free_gso_skb; + } + segs =3D skb_segment(skb, features); if (IS_ERR(segs)) { KUNIT_FAIL(test, "segs error %pe", segs); --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825305; cv=none; d=zohomail.com; s=zohoarc; b=DZ5fy1wnE/99qbfhYtIb7CHylG4TqhKYKIa2kVgja523sPrG5UrkGskwHYOX1RW2ZmLYnnxt8loWtqi9rTujyaEAzBq7URH9eavYibAWU9sBlZPOEhIY2jSAS3dNR+wNWyCdWuCXUmaSBGvPkWbfza6V03XuxtMwDoa5nOwOzIE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825305; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=NVn21fMcy6xP3x95gJReWbvgO5dQmcWPIIyj1sSFlXQ=; b=DnLPDnLwSgzP1fqC9po4OfzaR1RtefFsRIqklvWwZki6PlpnlF3UpeLVi5ENJXp6TVoOZ3Z1ybOqiOhexipaKWWTcqEThV69m2lf2xK5y587SnP+zMo3By0hB7ORHsRXC7J1AdHLeuucef9U5PFRu91Fd1oCNdx05XUi6LANzRA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825305570263.65008780094274; Wed, 4 Nov 2026 12:48:25 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472775.1680686 (Exim 4.92) (envelope-from ) id 1xOhtx-0005br-La; Wed, 04 Nov 2026 20:48:09 +0000 Received: by outflank-mailman (output) from mailman id 1472775.1680686; Wed, 04 Nov 2026 20:48:09 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtx-0005a9-21; Wed, 04 Nov 2026 20:48:09 +0000 Received: by outflank-mailman (input) for mailman id 1472775; Wed, 04 Nov 2026 20:48:07 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtv-0005FE-Jk for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:48:07 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtv-00FYc5-0I for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:48:07 +0100 Received: from [10.42.69.12] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb99e8-bab6-0a2a0a5309dd-0a2a450c9a30-38 for ; Wed, 04 Nov 2026 21:48:06 +0100 Received: from [209.85.160.169] (helo=mail-qt1-f169.google.com) by tlsNG-d25034.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb9a06-f479-0a2a450c0019-d155a0a9d174-3 for ; Wed, 04 Nov 2026 21:48:06 +0100 Received: by mail-qt1-f169.google.com with SMTP id d75a77b69052e-5363316fa0cso12558791cf.3 for ; Wed, 04 Nov 2026 12:48:06 -0800 (PST) Received: from toxicpanda.com ([153.61.196.253]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-54b10c4dcddsm33675341cf.20.2026.11.04.12.48.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:48:04 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825285; x=1794430085; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=NVn21fMcy6xP3x95gJReWbvgO5dQmcWPIIyj1sSFlXQ=; b=qkbNCB/VjwjgzW2BZrXb7Ljh6ZRisp9nLEmgAHchvKVC53C/TdHcvKF80Cx8dgUBk9 Bkw1pimbXpQvo+E8f5YrOJMHhQtED4b8BtjaTGg6TwudfZue/FRANTQoIhUXGQi0ta/x FzoGAjRIX6rLXtdMJSMd9wZBHEZ14kJjGijeuOqZ1KQVG9I8bYAyXJvU7eoTP8dOKYM8 t2jYfBm1QVFu8qmQ5qVYErtjWzGCSobzM7zwn4Qo8j9KUlFm+5rP1DpynlMYNgA7e3OG 1hG3kjKYpJI8u6jQ4uLf4pMP9bDDWiYwoI7yUSb4mJJXH25EwKAelj5qHMxNr0vR7Kjf 4N6w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825285; x=1794430085; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=NVn21fMcy6xP3x95gJReWbvgO5dQmcWPIIyj1sSFlXQ=; b=I4p6lLGKAne+4PYgqWiGAV4LN7C9YimOT1mI49THpX8jP6nvryKhs2/SZLiPqIy917 hv4hY0Q0xIAeEu1d03XfFYdwQpJExFKGvNzbxqGlZt/QitWrKFGdN+ATM5QR+r4brDcX r3t3J9v5pMUeFD6K1Dx9hwRylP7xnGYAHdpDpeh2/1Pxlu3lIonG1pa/KDlOGR5ed0Jc 61Dksk+dMlL5EpdCMG6bog9YDd4Nbo7CYpnorMRpbRJw6OJwH8xyS3x8IqRTbx0DK8ny PeeFSHyoiNsozlhme0RxYhMk2MHJTA/Ob41DfioW6JH9buajKuJrWKbygMaj44M/b4/P 2OXg== X-Forwarded-Encrypted: i=1; AKwUvBxuR5PgjXLbjaYbIsOjLh4knnaTSurjBmkSsrOx+V8Ic8UfwFLCPAN1uM8aWyPo2q9lRK4VQN4OCNk=@lists.xenproject.org X-Gm-Message-State: APuU4Z8niGa86vJAzZTHm0D6BrYr4ZIWRrK3c7jTYu0Sc4vhOPsznTsZ zQL6fF0xO4J/67MTgHkvlw6gcOqySKq7QW3t2eA8QCeEL+TXbQWtm8/0p4xizDTCvlo= X-Gm-Gg: AYBFou0yjXXAl65rmKUAmkmUnRnnVvUWwpypqbUr9fYSIlIEKfd0mcmC9auqSvHSY+b /X1Ny7IhFI1zJ4/lJmxJURN4tshnSAAolYahAJ2P0+ATQfV4RyG7paSnK4fRNyRn/qR5vSgtkyM 3m+VsSs2k70YrJuGj6o6DtrZVfLaO8cYjGgtkeAvAcf4warbQuNkI4nQ9csNxaF0v9oKgfX4vKd 3KVQEFxLuE4e3zMXs9ILsGaMwIO69wm7w5SmK8Yb/K08dS5kXBAsExOETjLTDb+N/ziuCXb1ZI8 Tnj7cGx8SxYP8kRmImeu3zqAWG3Oyu5gi6T5f5jX3HCvLRX/uT3LJ9xpLXtoO3goMQciZwD3iM1 luV4IyJwpV8m7vyikWzDGgTh0dYqptXMkmpHExonn2GRJ4buICJG/zVxSxWOEpLn9utyqQ7Y/VV Ci/oRdVW4fCUO1ac0/0i/ofJDOkLWnAqMx5zPh5nYfVEtTV6h33Vldb5hjzH6WD45Ngvexh2otm OUOnkfBdyZpHCY8EI5POiWdnigiykHxxCZBCekjXcV0DMRZpa+KuOin+5jZXJLdUVMYPavxY3Bd l08ucLgw7kyxQfsC1WIqBSTIFRVmqySHdFIvVdZyJKc3Mg== X-Received: by 2002:a05:622a:5919:b0:536:5ee8:cca9 with SMTP id d75a77b69052e-542b6780e91mr301127981cf.12.1793825285045; Wed, 04 Nov 2026 12:48:05 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:25 +0000 Subject: [PATCH net-next v4 13/15] xen-netfront: don't BUG() when skb_copy_bits() fails in bounce_skb() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-13-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825269; l=1259; i=josef@toxicpanda.com; h=from:subject:message-id; bh=zzsYthMv8IPVXjBtHviI0y09ueLAi8MeGKpMdcW0nP0=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QPdw7QRLxn5IZHZCHDO5ZCwaqrEZRXxs42UXzWDr7r7WRHwPZva73HxZD3G3reol2INnyXLXU4W ViF0TlWuOfAA= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d25034/1793825286-5290EA5B-C37E0449/0/0 X-purgate-type: clean X-purgate-size: 1261 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825306943158500 bounce_skb() is an open-coded skb_copy() into a page-aligned buffer, and it has the same BUG_ON(skb_copy_bits()). skb_copy_bits() fails when the skb's lengths don't add up or its frags are unreadable. bounce_skb() already frees the new skb and returns NULL when the allocation comes back misaligned, and xennet_start_xmit() drops the packet in that case. Take the same path, with a DEBUG_NET_WARN_ON_ONCE() for debug kernels. Reviewed-by: Juergen Gross Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- drivers/net/xen-netfront.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c index fdcb91042f29..17811d81937c 100644 --- a/drivers/net/xen-netfront.c +++ b/drivers/net/xen-netfront.c @@ -695,7 +695,12 @@ static struct sk_buff *bounce_skb(const struct sk_buff= *skb) /* Set the tail pointer and length */ skb_put(n, skb->len); =20 - BUG_ON(skb_copy_bits(skb, -headerlen, n->head, headerlen + skb->len)); + if (unlikely(skb_copy_bits(skb, -headerlen, n->head, + headerlen + skb->len))) { + DEBUG_NET_WARN_ON_ONCE(1); + kfree_skb(n); + return NULL; + } =20 skb_copy_header(n, skb); return n; --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825311; cv=none; d=zohomail.com; s=zohoarc; b=KUtZx5s5/ODC1GCbJIzaYR2Xr2Jq3Lx2FnFB8CcxgRJNdrF6OuSLQGCCicb/wnRa8Jdbgpq4qnfQNxejkjNVZ+tnybwb4DJ4rnaPnmZe6y/dECx96AiwVsruo5s5sneZ/I7Y53yiTQR+GrlvxNCTOJS8hkkpg2Yt0vuOFQipils= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825311; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=vm4X83cKQV2cViXLrBy8CdaLxj8kNgfl4SZFvLru4UA=; b=fCQ+d7O8uXm0K9iPyLlmdIlr/jQa/UmbJ/KSTeujOgciFKhppBDlWs0rJOL8smBf5Mjs6t61a7mokN0pdvkHmLtBi0V4yZOrKJ6Scdhfi9jwHQjeS4ZLtrySD/FnaQLdbwb8Me+B5KNiI90/cmulAbgx0Mcfi0yTWmD+dHp0o44= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825311676201.20879021081623; Wed, 4 Nov 2026 12:48:31 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472776.1680695 (Exim 4.92) (envelope-from ) id 1xOhtz-0005u1-7x; Wed, 04 Nov 2026 20:48:11 +0000 Received: by outflank-mailman (output) from mailman id 1472776.1680695; Wed, 04 Nov 2026 20:48:11 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhty-0005rS-Fm; Wed, 04 Nov 2026 20:48:10 +0000 Received: by outflank-mailman (input) for mailman id 1472776; Wed, 04 Nov 2026 20:48:09 +0000 Received: from mx.expurgate.net ([194.145.224.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtw-0005WC-R8 for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:48:08 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhtw-000QZ3-6r for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:48:08 +0100 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb9a01-8faa-0a2a0a5109dd-0a2a4501da4a-10 for ; Wed, 04 Nov 2026 21:48:08 +0100 Received: from [209.85.222.174] (helo=mail-qk1-f174.google.com) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb9a07-5984-0a2a45010019-d155deaed51d-3 for ; Wed, 04 Nov 2026 21:48:08 +0100 Received: by mail-qk1-f174.google.com with SMTP id af79cd13be357-93e635220b4so106364985a.1 for ; Wed, 04 Nov 2026 12:48:07 -0800 (PST) Received: from toxicpanda.com ([153.61.196.245]) by smtp.gmail.com with ESMTPSA id af79cd13be357-945d4899dc6sm292004485a.43.2026.11.04.12.48.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:48:06 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825287; x=1794430087; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vm4X83cKQV2cViXLrBy8CdaLxj8kNgfl4SZFvLru4UA=; b=fj+3rV7D0DZObpoMlJckGVvFKWfGqQ2jCB/kCt8UdEYuqPeQm2pjfioUBQwavCqysO 4gjdVkHwcqiv/SgLCR7IBY5BHjdiLu4ei32bxle5N/bMBwbmNKwpoZKTxC8mr+x+nCRB PYTDVcuXFa3MCRXYveVMZEl+hzRRw1nY0zI/b5f9Azuz/5lpzFoVpXwam2fo5ZgwClNZ cG6CkKrx3k/64ezKXtm3ePmoWhwLi16aG9+XsfCeLHrLve8yxhJlt4WeYNh4UQqFyRq1 Szrcs2SPid1UAY+NjcyNcJExL8AVuiTdTxIY/r4PKtoSPzZgwmyB1+KkECDW1cwv4eVp TOdg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825287; x=1794430087; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=vm4X83cKQV2cViXLrBy8CdaLxj8kNgfl4SZFvLru4UA=; b=b++Wj5QkA3uaVtIK9cEYoAGsDc8gPBi6ytEtNAUPJEz5H89P9UelF5OgbQNlVk8qLx dif1QWrJONccpY9Tjrfya16BONlciISYQl7LT4AsNAnvawSSS4+fWR/7D2r1bNz1IuAm asXk5fakn4s48nua83/SwmrPQmTMLNqxaHQyg8koALm4onj6KTIkF5O66vBg5hYNqkot 9Pp/j/5L+SvetmMrhRcryBGT6U/T6gmYKYY/HTizIODXCdZYAXKVMyrkUMsr8spohNWU zUcyqNNrXw5QBO+FzyT4h2cL4ur4P5zxWvgbCI8qmqnH3Z7I5/46mJThEfUETXiYDtXQ giBA== X-Forwarded-Encrypted: i=1; AKwUvBymSLjRPMvFaRip90XmDJxM8NGrlXZdhfbxO4cQd15Gv317svlBxqBgvd0xtThbTGfbYiBi+4+jAOY=@lists.xenproject.org X-Gm-Message-State: APuU4Z9u1ENBFh/oTwdwxdbxegInrq0a3AcHOVXM4hez0Xj3L6QgrGS2 5Rs7T/X1wHnuYvFSxZ5Kr7f5JSSeYzkaqA/FnSl9nleNHku+AAOTRZ9dKYjSrtszq9M= X-Gm-Gg: AYBFou3o0/uJ7PZqOuy5DubSrOPqNNh2NyRwQ17zXb23y0W8bzcin48wUi/FJ0jbP08 sZ21F5TEa8sW5RJTk1AhpfRTKMZBjI2+FHDr99LyQ4KhgikOekTldUa9idbVXIWJUaM836Bi1Iy AMm/sjSSW54rNcrP+K6cE62pCT2mqCfmNR/g88mIVoVnrTSElEpbu9pqDdlCSXjAfQIfbwpSxA9 PD7Va59LzuC6CUApX8okG6X6EBodTUrTPdDWQuAKQm6DOsXBL7DDF4dOEHl8x9tWqARDgaGX1Ij MLq2OR7ZZe/4ZcinQcoLpVjFHBr59U0z6/a1k+Sp+jNTYHyGgFKeunJxdlO8z5hVuh8MK57pe/U PIz3yPKRBeMWSkft0VhboCAUiTcZs7yYIGzKwolQFskfv47EPZrQFSYYZxETMFS70q/ZK2aXTp8 U2iwaxKgDp53uAsHAjPIVsFD4fsE6wQtyEy/Jr4zUA2VENE2f6oDi/+HUeVgvjwzVs2aynPEOXS EyMBohcHq7TP9ZpZHdwdNvilg4inL9gZ5qDrRlW2mc3sxUxXvyPNBNGs1NUIKduml8U/QcF6qoc 6V2JUixkYKPrtTQcmkMDuxLMg2MfseU7KB2rwYPRN4NBsqYh1JBr8yDEnfVo8FeY2yY= X-Received: by 2002:a05:620a:4043:b0:93f:31f0:6a7f with SMTP id af79cd13be357-9442172a5c1mr3191494585a.69.1793825286622; Wed, 04 Nov 2026 12:48:06 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:26 +0000 Subject: [PATCH net-next v4 14/15] net/tls: don't BUG() on leftover length in __skb_nsg() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-14-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825269; l=1573; i=josef@toxicpanda.com; h=from:subject:message-id; bh=jtewRftckK13p/nQalxWcrhfGpFqhqstsSARsz5AoHI=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QDKngciEsEX8JG2Ad0fN9Mloe1uVw1/l2WZ7sISbd/Ng5VMersZpizDOJC2J3tEMBwMooCA/YD/ B+ZXmrDCaGAc= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-d62444/1793825288-1EE60757-E8A99555/0/0 X-purgate-type: clean X-purgate-size: 1575 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825313040158500 __skb_nsg() counts the scatterlist entries for a range of an skb with a copy of the __skb_to_sgvec() walk, including its BUG_ON(len) when the skb runs out before the range does. tls_decrypt_sg() calls it on the same range it then passes to skb_to_sgvec(), so a bad range would BUG() here before it got to skb_to_sgvec()'s error return. __skb_nsg() already returns -EMSGSIZE for a frag_list nested too deep, and tls_decrypt_sg() fails the record on any return below 1. Return -EINVAL for the leftover length too, with a DEBUG_NET_WARN_ON_ONCE() for debug kernels, and say so in the comment above skb_nsg(). Acked-by: Mina Almasry Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/tls/tls_sw.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index 771e02bff519..748ae27f2b88 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -142,12 +142,16 @@ static int __skb_nsg(struct sk_buff *skb, int offset,= int len, start =3D end; } } - BUG_ON(len); + if (unlikely(len)) { + DEBUG_NET_WARN_ON_ONCE(1); + return -EINVAL; + } return elt; } =20 /* Return the number of scatterlist elements required to completely map the - * skb, or -EMSGSIZE if the recursion depth is exceeded. + * skb, -EMSGSIZE if the recursion depth is exceeded, or -EINVAL if the skb + * runs out before @len does. */ static int skb_nsg(struct sk_buff *skb, int offset, int len) { --=20 2.55.0 From nobody Thu Nov 5 07:32:53 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org ARC-Seal: i=1; a=rsa-sha256; t=1793825308; cv=none; d=zohomail.com; s=zohoarc; b=AwtJYPIA6d9DpIFflp9v84XqdcOK2fjO9VrFDCMrXaSIVRV748CZwhGzYx4WExgx8l5rO7kV+6ojPP+7nYodyw9bBKm5hyJdgzSGb/XCJaRJhNw9Nypy6PUYe//5J9w7g9aYo3we3sX3eNZ8uE8GSy7AAXuClThZbnc/O24JvLw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1793825308; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=UbSwO3gZAlShSf8y/3JGnXMddTOZvjpIdY8ib59dlm8=; b=iqyrNvo6Jwx0rYEQIPf4JPy5weZm1o8y7pPEE2uaSEbnECOKFZTvTF5QijgL4Y+D2DnrB9J+KAakHSqVxB+OingLrdf+2Cu3yV9y1pRdMm9bddEX/JK1HjU+G/2eROh/wk3NqCi7M455GO6l+HkugNSK9IHC6GmDv5Mp0NYiekk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1793825308803845.3116842258308; Wed, 4 Nov 2026 12:48:28 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.1472780.1680707 (Exim 4.92) (envelope-from ) id 1xOhu1-0006Tj-SR; Wed, 04 Nov 2026 20:48:13 +0000 Received: by outflank-mailman (output) from mailman id 1472780.1680707; Wed, 04 Nov 2026 20:48:13 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhu1-0006QU-AN; Wed, 04 Nov 2026 20:48:13 +0000 Received: by outflank-mailman (input) for mailman id 1472780; Wed, 04 Nov 2026 20:48:11 +0000 Received: from mx.expurgate.net ([195.190.135.20]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1xOhtz-0005xS-2x for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 20:48:11 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1xOhty-00DUt0-FD for xen-devel@lists.xenproject.org; Wed, 04 Nov 2026 21:48:10 +0100 Received: from [10.42.69.6] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6aeb9a03-2eae-0a2a0a5409dd-0a2a45069bb8-14 for ; Wed, 04 Nov 2026 21:48:10 +0100 Received: from [209.85.222.177] (helo=mail-qk1-f177.google.com) by tlsNG-16d1c6.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6aeb9a09-195a-0a2a45060019-d155deb1f143-3 for ; Wed, 04 Nov 2026 21:48:10 +0100 Received: by mail-qk1-f177.google.com with SMTP id af79cd13be357-93f079a63b8so112332785a.3 for ; Wed, 04 Nov 2026 12:48:10 -0800 (PST) Received: from toxicpanda.com ([153.61.196.253]) by smtp.gmail.com with ESMTPSA id af79cd13be357-945d483d762sm294338885a.27.2026.11.04.12.48.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Nov 2026 12:48:07 -0800 (PST) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=google header.d=toxicpanda.com header.i="@toxicpanda.com" header.h="Cc:To:In-Reply-To:References:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=toxicpanda.com; s=google; t=1793825288; x=1794430088; darn=lists.xenproject.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UbSwO3gZAlShSf8y/3JGnXMddTOZvjpIdY8ib59dlm8=; b=YIqhOJN7ZCzDLcp9eweAn2J7TdnGMx4sCzPFuN9HZ5SZUxk50OYO6UE7CNfjcqROIS 1hzB9bS6SdTQ8KuFb/wRVcJgUVXE5L87ktEucpDLcOAxRgKmmGIgguLyrXm3EXZWZysj dSnAnsuoB9bwQnUEmzQcrCHbtVdanV4mDOUo2Is+kxsfih0oHEsU1N2Euw8fwAKGZIrM Kqb5b9iqQJWSuvP8gd2R05GZduYtPkoiKzisHta4RK3mrHnWfBztFJzJ5MCa380zx6xi 2g9vyEyaB93JkLzcFdHnNogWQ7hC3+B+BZYg3uCgbpspHRbweV1KBmt3FRXaa0Lgola0 Sfaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793825288; x=1794430088; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=UbSwO3gZAlShSf8y/3JGnXMddTOZvjpIdY8ib59dlm8=; b=uW0TDYwG9/b29OSSV9cECXuCF9LdWCKQFJfbfCKYXLIev/v3OwE+RBvXrRVVlL+HiI opnqoEz143kBuuzU+Nx6sw/xtirKGWvcXi/wewnkXVNRm2Fg1xHtZMyZQ/ezg/wsrYth MN7NBxTCQgJVFTjHxC74WTRO1Cc3qebFDKeeWJ/qTB9IM4histfBJUdbFBxBfoIYo2KE ddE6a5UgVSPXqtSjAr+8mNFNcS2QSlsWIywqizyAHgwMLGy/b1It/DR5kjn+E9CL4WYP sDpfETfs1jf2/uYXVLLA4HEL/40sfbzASE2IdOmrTa0AUJssyz1PzqtWwOM2ZuX9oYAs qHMA== X-Forwarded-Encrypted: i=1; AKwUvBxc6KJtExaxmMNkAyKbYY5tVbRPXyrEeH+alqRxRXDxC77sq71si8kziKUnlfN7E/R5dTT5wt+3oVA=@lists.xenproject.org X-Gm-Message-State: APuU4Z9xDhj7H7FoBkkGevxSE7SzjLp8INq+GZI/ilfsqsGCw/W2tOC2 PU5WDh7ZuamnP9ifTRyKG5qzbmv4tRtlgMLj8q0Bys230aa87udbu3QP0GuQe1zAKZA= X-Gm-Gg: AYBFou2+agZqlT+5vKCHQAgQd7rqJlSMLMHgLU0+uNZ6fvt6Y1qOcWw4Z/IckUlievX wqp06zSarzX+zA3cbHQHG95rzC9RNy4RznBjJOu/QpI9DBs+GTSQkiC1EbCzhd+kwcbF3Hhbu2E y8Y1W7q9IWKphrd0+mKN/vikEgpLqMqQBNP3wxT8I2fHMncDq45Wl5xsp2JrNjvNt0oVRKcp2Jn g0t4mPSeG3mtvx5L/RPX5KJT6MrM/lMMrjQq8/L4SQYqbvt/OjnVSom5f/IeSuNUj/puopQG+Lk es2SG7SEQuCjmkJTZoZNgLnzuT2Lh851DsvL1p8xuzqgTlv1eU48kw1AufU7yGMo7CUwxffTr90 Obbrc7NNpRsyL4ZIr1WiIQQQR9L1uiNQyn2QBR5evWKxZ002BHCyQ2nkgsXBBrcqecyW9JvzUuU eVrBA/e+x3W6338xoYJR1e+7qIzGlRHFiMLAvymiFApkyXl4s/dW/krzlECdu/q8424OEmjZUn1 LVoGtGZOk4/uooMnQncKpSokyCKKLa7EV6ZtZO5aIrU/OvXSVpLwMLdF9Qze+HKAoJUiFRz4bsE l9VQluTaVGV6nTZgXHTtbPuD17YIMa9XfvKVb1C/+xCnlA== X-Received: by 2002:a05:620a:a905:b0:945:b9c8:de5a with SMTP id af79cd13be357-945b9c8dedbmr1356158885a.20.1793825287918; Wed, 04 Nov 2026 12:48:07 -0800 (PST) From: Josef Bacik Date: Wed, 04 Nov 2026 20:47:27 +0000 Subject: [PATCH net-next v4 15/15] net: update comments that still describe the skb BUG_ON()s MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20261104-b4-skbuff-bug-on-followups-v4-15-b7ffeb364f5d@toxicpanda.com> References: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> In-Reply-To: <20261104-b4-skbuff-bug-on-followups-v4-0-b7ffeb364f5d@toxicpanda.com> To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Andrew Lunn Cc: Juergen Gross , Stefano Stabellini , Willem de Bruijn , Fernando Fernandez Mancera , Mina Almasry , David Laight , netdev@vger.kernel.org, xen-devel@lists.xenproject.org, Josef Bacik X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openssh-sha256; t=1793825269; l=2967; i=josef@toxicpanda.com; h=from:subject:message-id; bh=EAJ0bQj/Oj/in9lIWu/G1LG29YPEIg8lFuBrNd3Sw5Q=; b=U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgUBr36M/n0nWN0DNbnxwzIiCZez6MG JiruuNaSCI/zXsAAAAGcGF0YXR0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5AAAA QHf4WC7tdHNHClwRAYr93iv9/GKE9HPJjZnVhEDjCwlX4VLZbqFYVp2C6I1QijW+aNqGzDet3wR d30tDtFHCMgo= X-Developer-Key: i=josef@toxicpanda.com; a=openssh; fpr=SHA256:C8kOX2QUJCMqnCX+KEeoqRAjLo9L+ELOSH2NSAJHqGA X-purgate-ID: tlsNG-16d1c6/1793825290-F6A7477B-32DDD58F/0/0 X-purgate-type: clean X-purgate-size: 2969 X-ZohoMail-DKIM: pass (identity @toxicpanda.com) X-ZM-MESSAGEID: 1793825311013158500 The skbuff BUG_ON() conversions left a few comments behind: - bpf_skb_net_grow() says skb_segment() BUG()s on a frag_list with head_frag set at the downgraded MSS. It fails the segmentation and the packet is dropped, which is still why the skb gets linearized. - The skb_to_sgvec() kernel-doc doesn't list the -EINVAL that __skb_to_sgvec() returns when @offset and @len run past the end of the skb. - A comment in the netmem KUnit test names BUG_ON(i >=3D nfrags) in skb_segment(), which is a check that fails the segmentation now. No functional change. Acked-by: Mina Almasry Signed-off-by: Josef Bacik Reviewed-by. It makes skb_copy_and_csum_bits() report failure, and the --- net/core/filter.c | 6 +++--- net/core/net_test.c | 2 +- net/core/skbuff.c | 5 +++-- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 09c60a58c82a..9881ac89e94c 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -3723,9 +3723,9 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 = off, u32 len_diff, shinfo->gso_segs =3D 0; =20 /* Due to header growth, MSS needs to be downgraded. - * There is a BUG_ON() when segmenting the frag_list with - * head_frag true, so linearize the skb after downgrading - * the MSS. + * Segmenting a frag_list with head_frag true at the new MSS + * fails and the packet gets dropped, so linearize the skb + * after downgrading the MSS. */ if (!(flags & BPF_F_ADJ_ROOM_FIXED_GSO)) { skb_decrease_gso_size(shinfo, len_diff); diff --git a/net/core/net_test.c b/net/core/net_test.c index 03203454cd19..976d14896251 100644 --- a/net/core/net_test.c +++ b/net/core/net_test.c @@ -1524,7 +1524,7 @@ static void netmem_ref_test_skb_segment(struct kunit = *test) /* 5. Linear head_skb (nr_frags=3D0) + mixed pp_recycle frag_list where * member A has linear + frag (pp_recycle=3D1) and tail member B has * linear len =3D=3D skb_headlen(A) (pp_recycle=3D0): keeps SG clone path - * synchronized without hitting BUG_ON(i >=3D nfrags). + * synchronized without failing the i >=3D nfrags check. */ head =3D alloc_skb(64, GFP_KERNEL); list =3D alloc_skb(64, GFP_KERNEL); diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 45cd77e153f1..29951ce11850 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -5641,8 +5641,9 @@ __skb_to_sgvec(struct sk_buff *skb, struct scatterlis= t *sg, int offset, int len, * * Fill the specified scatter-gather list with mappings/pointers into a * region of the buffer space attached to a socket buffer. Returns either - * the number of scatterlist items used, or -EMSGSIZE if the contents - * could not fit. + * the number of scatterlist items used, -EMSGSIZE if the contents + * could not fit, or -EINVAL if @offset and @len run past the end of + * the skb. */ int skb_to_sgvec(struct sk_buff *skb, struct scatterlist *sg, int offset, = int len) { --=20 2.55.0