From: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
To: Josef Bacik <josef@toxicpanda.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@kernel.org>,
Jakub Kicinski <kuba@kernel.org>,
Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
Andrew Lunn <andrew+netdev@lunn.ch>
Cc: Juergen Gross <jgross@suse.com>,
Stefano Stabellini <sstabellini@kernel.org>,
Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
Fernando Fernandez Mancera <fmancera@suse.de>,
Mina Almasry <almasrymina@google.com>,
David Laight <david.laight.linux@gmail.com>,
netdev@vger.kernel.org, xen-devel@lists.xenproject.org,
Josef Bacik <josef@toxicpanda.com>
Subject: Re: [PATCH net-next 12/15] net: test the frag_list layouts skb_segment() refuses
Date: Tue, 20 Oct 2026 16:17:39 -0400 [thread overview]
Message-ID: <willemdebruijn.kernel.22d6042aad0ba@gmail.com> (raw)
In-Reply-To: <20261019-b4-skbuff-bug-on-followups-v1-12-41dbef50b9f7@toxicpanda.com>
Josef Bacik wrote:
> The GSO KUnit test only checks layouts skb_segment() can segment. Add
> two it has to refuse with -EINVAL: the non-uniform frag_list with SG
> on, which used to hit the BUG_ON(i >= nfrags) the existing test steps
> around, and a frag_list member that has its own frag_list.
>
> Both warn on CONFIG_DEBUG_NET kernels, so run them with the warning
> backtrace suppressed.
>
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Thanks!
> ---
> net/core/net_test.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 48 insertions(+)
>
> diff --git a/net/core/net_test.c b/net/core/net_test.c
> index bc2ef7612e7d..12a175268a01 100644
> --- a/net/core/net_test.c
> +++ b/net/core/net_test.c
> @@ -39,6 +39,8 @@ enum gso_test_nr {
> GSO_TEST_RESEGMENT_MULTI,
> GSO_TEST_RESEGMENT_TAIL,
> GSO_TEST_RESEGMENT_ONE_MSS,
> + GSO_TEST_FRAG_LIST_NON_UNIFORM_SG,
> + GSO_TEST_FRAG_LIST_NESTED,
> };
>
> struct gso_test_case {
> @@ -57,6 +59,9 @@ struct gso_test_case {
> unsigned int nr_segs;
> const unsigned int *segs;
> const unsigned int *gso_segs;
> +
> + /* skb_segment() is expected to fail with this error */
> + int err;
> };
>
> static struct gso_test_case cases[] = {
> @@ -204,6 +209,28 @@ static struct gso_test_case cases[] = {
> },
> .gso_segs = (const unsigned int[]) { 0, 0, 0, 0 },
> },
> + {
> + /* frag_list members that don't end on gso_size boundaries
> + * can't be segmented with SG
> + */
> + .id = GSO_TEST_FRAG_LIST_NON_UNIFORM_SG,
> + .name = "frag_list_non_uniform_sg",
> + .linear_len = GSO_TEST_SIZE,
> + .nr_frag_skbs = 4,
> + .frag_skbs = (const unsigned int[]) { GSO_TEST_SIZE, 1, GSO_TEST_SIZE, 2 },
> + .err = -EINVAL,
> + },
> + {
> + /* the second frag_list member hangs off the first one's
> + * frag_list instead of off the head's
> + */
> + .id = GSO_TEST_FRAG_LIST_NESTED,
> + .name = "frag_list_nested",
> + .linear_len = GSO_TEST_SIZE,
> + .nr_frag_skbs = 2,
> + .frag_skbs = (const unsigned int[]) { GSO_TEST_SIZE, GSO_TEST_SIZE },
> + .err = -EINVAL,
> + },
> };
>
> static void gso_test_case_to_desc(struct gso_test_case *t, char *desc)
> @@ -283,6 +310,15 @@ static void gso_test_func(struct kunit *test)
>
> if (tcase->id == GSO_TEST_GSO_BY_FRAGS)
> skb_shinfo(skb)->gso_size = GSO_BY_FRAGS;
> +
> + if (tcase->id == GSO_TEST_FRAG_LIST_NESTED) {
> + struct sk_buff *first = skb_shinfo(skb)->frag_list;
> +
> + skb_shinfo(first)->frag_list = first->next;
> + first->next = NULL;
> + first->len += tcase->frag_skbs[1];
> + first->data_len += tcase->frag_skbs[1];
> + }
> }
>
> features = NETIF_F_SG | NETIF_F_HW_CSUM;
> @@ -296,6 +332,18 @@ static void gso_test_func(struct kunit *test)
> features &= ~NETIF_F_SG;
>
> SKB_GSO_CB(skb)->max_segs = tcase->max_segs;
> +
> + if (tcase->err) {
> + /* the suppression block doesn't run if it can't be set up */
> + segs = NULL;
> + kunit_warning_suppress(test)
> + segs = skb_segment(skb, features);
nit: if respinning, add braces
> + KUNIT_EXPECT_EQ(test, PTR_ERR_OR_ZERO(segs), tcase->err);
> + if (!IS_ERR_OR_NULL(segs))
> + kfree_skb_list(segs);
> + goto free_gso_skb;
> + }
> +
> segs = skb_segment(skb, features);
> if (IS_ERR(segs)) {
> KUNIT_FAIL(test, "segs error %pe", segs);
>
> --
> 2.55.0
>
next prev parent reply other threads:[~2026-10-20 20:17 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-19 13:50 [PATCH net-next 00/15] net: skbuff: follow-ups to the BUG_ON() removal Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 01/15] net: skbuff: make skb_copy_and_csum_bits() report unreadable frags Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 02/15] net: skbuff: add skb_checksum_full() that reports failure Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 03/15] net: skbuff: fail checksum validation when the skb can't be checksummed Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 04/15] net: skbuff: fail segmentation when a segment " Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 05/15] net: skbuff: fail pskb_trim_rcsum() when it can't checksum the tail Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 06/15] net: skbuff: add skb_crc32c_full() that reports failure Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 07/15] net: skbuff: let skb_zerocopy() copy a short skb without head_frag Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 08/15] net: skbuff: make skb_try_coalesce()'s len unsigned Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 09/15] net: skbuff: check csum_start against len in skb_copy_and_csum_dev() Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 10/15] net: skbuff: reject a negative length in skb_copy_and_csum_bits() Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 11/15] net: skbuff: refuse to segment a nested frag_list Josef Bacik
2026-10-20 20:09 ` Willem de Bruijn
2026-10-19 13:50 ` [PATCH net-next 12/15] net: test the frag_list layouts skb_segment() refuses Josef Bacik
2026-10-20 20:17 ` Willem de Bruijn [this message]
2026-10-19 13:50 ` [PATCH net-next 13/15] xen-netfront: don't BUG() when skb_copy_bits() fails in bounce_skb() Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 14/15] net/tls: don't BUG() on leftover length in __skb_nsg() Josef Bacik
2026-10-19 15:12 ` Mina Almasry
2026-10-19 16:22 ` Willem de Bruijn
2026-10-19 16:27 ` Mina Almasry
2026-10-19 13:50 ` [PATCH net-next 15/15] net: update comments that still describe the skb BUG_ON()s Josef Bacik
2026-10-19 15:09 ` Mina Almasry
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=willemdebruijn.kernel.22d6042aad0ba@gmail.com \
--to=willemdebruijn.kernel@gmail.com \
--cc=almasrymina@google.com \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=david.laight.linux@gmail.com \
--cc=edumazet@kernel.org \
--cc=fmancera@suse.de \
--cc=horms@kernel.org \
--cc=jgross@suse.com \
--cc=josef@toxicpanda.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sstabellini@kernel.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.