Previously, hinic3_send_one_skb() cached the SKB fragment count before
calling hinic3_tx_offload(). If hinic3_tx_csum() falls back to
skb_checksum_help() for unsupported tunnel packets, the SKB may be
linearized. Continuing to build the TX descriptor with the stale
fragment count leads to a descriptor mismatch, which can trigge
out-of-bounds DMA reads or IOMMU faults.

Furthermore, the old code ignored the return value of skb_checksum_help(),
transmitting corrupted packets with incomplete checksums upon failure. It
also failed to increment drop statistics across various TX error paths,
causing packets to be dropped silently without notifying the user.

Fix this by:
1. Moving the hinic3_tx_offload() call before calculating 'num_sge' to
   ensure the correct fragment count is used if the SKB is linearized.
2. Propagating skb_checksum_help() errors and returning
   HINIC3_TX_OFFLOAD_INVALID to properly drop the skb.
3. Adding missing statistics increments (dropped, map_frag_err,
   unknown_tunnel_pkt, skb_pad_err) across the TX error paths so these
   events are correctly reflected in interface statistics.

Fixes: 17fcb3dc12bb ("hinic3: module initialization and tx/rx logic")
Co-developed-by: Teng Peisen <tengpeisen@huawei.com>
Signed-off-by: Teng Peisen <tengpeisen@huawei.com>
Co-developed-by: Wu Di <wudi234@huawei.com>
Signed-off-by: Wu Di <wudi234@huawei.com>
Signed-off-by: Fan Gong <gongfan1@huawei.com>
---
 drivers/net/ethernet/huawei/hinic3/hinic3_tx.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c b/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c
index 9306bf0020ca..cc541e7a2318 100644
--- a/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c
+++ b/drivers/net/ethernet/huawei/hinic3/hinic3_tx.c
@@ -261,8 +261,7 @@ static int hinic3_tx_csum(struct hinic3_txq *txq, struct hinic3_sq_task *task,
 		    ((struct udphdr *)skb_transport_header(skb))->dest !=
 		    VXLAN_OFFLOAD_PORT_LE) {
 			/* Unsupported tunnel packet, disable csum offload */
-			skb_checksum_help(skb);
-			return 0;
+			return skb_checksum_help(skb);
 		}
 	}

@@ -412,6 +411,10 @@ static u32 hinic3_tx_offload(struct sk_buff *skb, struct hinic3_sq_task *task,
 		offload |= HINIC3_TX_OFFLOAD_TSO;
 	} else {
 		tso_cs_en = hinic3_tx_csum(txq, task, skb);
+		if (tso_cs_en < 0) {
+			offload = HINIC3_TX_OFFLOAD_INVALID;
+			return offload;
+		}
 		if (tso_cs_en)
 			offload |= HINIC3_TX_OFFLOAD_CSUM;
 	}
@@ -545,6 +548,7 @@ static netdev_tx_t hinic3_send_one_skb(struct sk_buff *skb,
 		skb->len = MIN_SKB_LEN;
 	}

+	offload = hinic3_tx_offload(skb, &task, &queue_info, txq);
 	num_sge = skb_shinfo(skb)->nr_frags + 1;
 	/* assume normal wqe format + 1 wqebb for task info */
 	wqebb_cnt = num_sge + 1;
@@ -560,7 +564,6 @@ static netdev_tx_t hinic3_send_one_skb(struct sk_buff *skb,
 		return NETDEV_TX_BUSY;
 	}

-	offload = hinic3_tx_offload(skb, &task, &queue_info, txq);
 	if (unlikely(offload == HINIC3_TX_OFFLOAD_INVALID)) {
 		goto err_drop_pkt;
 	} else if (!offload) {

base-commit: 2195424c3da2ef1829a63b807e3a900a90e57d85
--
2.54.0

On Mon, Aug 10, 2026 at 08:57:32AM +0800, Fan Gong wrote:
> Previously, hinic3_send_one_skb() cached the SKB fragment count before
> calling hinic3_tx_offload(). If hinic3_tx_csum() falls back to
> skb_checksum_help() for unsupported tunnel packets, the SKB may be
> linearized. Continuing to build the TX descriptor with the stale
> fragment count leads to a descriptor mismatch, which can trigge
> out-of-bounds DMA reads or IOMMU faults.
> 
> Furthermore, the old code ignored the return value of skb_checksum_help(),
> transmitting corrupted packets with incomplete checksums upon failure. It
> also failed to increment drop statistics across various TX error paths,
> causing packets to be dropped silently without notifying the user.
> 
> Fix this by:
> 1. Moving the hinic3_tx_offload() call before calculating 'num_sge' to
>    ensure the correct fragment count is used if the SKB is linearized.
> 2. Propagating skb_checksum_help() errors and returning
>    HINIC3_TX_OFFLOAD_INVALID to properly drop the skb.
> 3. Adding missing statistics increments (dropped, map_frag_err,
>    unknown_tunnel_pkt, skb_pad_err) across the TX error paths so these
>    events are correctly reflected in interface statistics.

Did part 3 go missing?
I'm not seeing it in the patch.

> 
> Fixes: 17fcb3dc12bb ("hinic3: module initialization and tx/rx logic")
> Co-developed-by: Teng Peisen <tengpeisen@huawei.com>
> Signed-off-by: Teng Peisen <tengpeisen@huawei.com>
> Co-developed-by: Wu Di <wudi234@huawei.com>
> Signed-off-by: Wu Di <wudi234@huawei.com>
> Signed-off-by: Fan Gong <gongfan1@huawei.com>

Also, this seems to be v3 of this patch.
For reference, that should be noted in the subject like this:

Subject: [PATCH v3 net] ...