Re: [PATCH net v04] hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed

[Simon Horman <horms@kernel.org>]

On Tue, Aug 11, 2026 at 07:43:59PM +0800, Fan Gong wrote:
> Previously, hinic3_send_one_skb() cached the skb fragment count before
> calling hinic3_tx_offload(). If hinic3_tx_csum() falls back to
> skb_checksum_help() for unsupported tunnel packets, the skb may be
> linearized. Continuing to build the TX descriptor with the stale
> fragment count leads to a descriptor mismatch, which can trigger
> out-of-bounds DMA reads or IOMMU faults.
> 
> Furthermore, the old code ignored the return value of skb_checksum_help(),
> transmitting corrupted packets with incomplete checksums upon failure.
> 
> Fix this by:
> 1. Moving the hinic3_tx_offload() call before calculating 'num_sge' to
>    ensure the correct fragment count is used if the SKB is linearized.
> 2. Propagating skb_checksum_help() errors and returning
>    HINIC3_TX_OFFLOAD_INVALID to properly drop the skb.
> 
> Fixes: 17fcb3dc12bb ("hinic3: module initialization and tx/rx logic")
> Co-developed-by: Teng Peisen <tengpeisen@huawei.com>
> Signed-off-by: Teng Peisen <tengpeisen@huawei.com>
> Co-developed-by: Wu Di <wudi234@huawei.com>
> Signed-off-by: Wu Di <wudi234@huawei.com>
> Signed-off-by: Fan Gong <gongfan1@huawei.com>

Thanks,

I do think this change is fine as it addresses the issue described.

Reviewed-by: Simon Horman <horms@kernel.org>

But you may want to consider some follow-up based on the AI-generated
review of v1 that was forwarded by Jakub:

https://lore.kernel.org/netdev/20260806162138.2749871-1-kuba@kernel.org/

...