Re: [PATCH net] net: reject a negative TCP header offset in qdisc_pkt_len_segs_init()

["Alexei Starovoitov" <alexei.starovoitov@gmail.com>]

On Wed Nov 4, 2026 at 8:41 AM UTC, Paolo Abeni wrote:
> On 11/2/26 23:46, Alexei Starovoitov wrote:
>> On Mon, Nov 02, 2026 at 11:44 AM sashiko-bot@kernel.org <sashiko-bot@kernel.org> wrote:
>>>> +		/* A header in front of skb->data gives a negative offset. */
>>>> +		if ((int)hdr_len < 0 ||
>>>> +		    !pskb_may_pull(skb, hdr_len + sizeof(struct tcphdr)))
>>>>   			return SKB_DROP_REASON_SKB_BAD_GSO;
>>>
>>> [Severity: High]
>>> Should the (int)hdr_len < 0 check be placed immediately after hdr_len is
>>> computed rather than only inside the SKB_GSO_TCPV4 | SKB_GSO_TCPV6 branch?
>> 
>> No. It's already explained in the commit log.
>> 
>>> When (int)hdr_len < -8, hdr_len + sizeof(struct udphdr) wraps to an
>>> unsigned int in [0x80000008, 0xffffffff] (> INT_MAX), which triggers
>>> DEBUG_NET_WARN_ON_ONCE(len > INT_MAX) in
>>> include/linux/skbuff.h:pskb_may_pull_reason() before returning
>>> SKB_DROP_REASON_SKB_BAD_GSO.
>> 
>> Not a bug. That's CONFIG_DEBUG_NET only and the warn is right:
>> the header is stale.
>> 
>>> Can this write uh->len (and uh->check in bnxt_sw_udp_gso_xmit() and
>>> enetc_tso_hdr_csum()) before the start of the header buffer when
>>> skb_transport_offset(skb) < -4?
>> 
>> No. The driver doesn't see this offset.
>> 
>>> Third, for other GSO types (such as SKB_GSO_FRAGLIST, SKB_GSO_UDP,
>>> SKB_GSO_SCTP, or SKB_GSO_ESP), hdr_len remains 2^32 - |offset| at the end
>>> of qdisc_pkt_len_segs_init():
>>>
>>> When (gso_segs - 1) * |offset| > skb->len, can qdisc_skb_cb(skb)->pkt_len
>>> underflow in 32-bit unsigned arithmetic to ~4.29 GiB (exceeding
>>> QDISC_PKT_LEN_MAX), causing deficit-based schedulers such as drr_dequeue()
>>> and ets_dequeue() to spin in their deficit-refill loops?
>> 
>> No.
>
> FTR the nipa sashiko instance dismissed the above concerns autonomously:
>
> https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261101194433.2637113-1-alexei.starovoitov@gmail.com
>
> you can reasonably safely refer only to such instance when submitting
> patches to net/net-next.

Nice. I'll borrow your mechanism.