Re: [PATCH net v4 1/8] xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] The patch incompletely fixes the WARN_ON_ONCE in skb_checksum_help() triggered by pure-fragment SKBs. It successfully prevents the explicit fallback in xsk_skb_metadata() (which wedged the TX ring), but leaves the implicit generic network stack fallback vulnerable. If a user sets XDP_TXMD_FLAGS_CHECKSUM on an IFF_TX_SKB_NO_LINEAR device and the hardware checksum offload is disabled at runtime (e.g., via `ethtool -K eth0 tx off`), the core stack's validate_xmit_skb() takes over. Because NETIF_F_SG is allowed to remain active even without checksum features, skb_needs_linearize() evaluates to false, leaving the SKB unlinearized. The SKB is then passed to skb_csum_hwoffload_help() -> skb_checksum_help(), which hits the exact same WARN_ON_ONCE(offset >= skb_headlen(skb)) because skb_headlen is 0.
--

commit 86ab0a4900aa60bee0c3df7393a2846b5ff74ccb
Author: Jason Xing <kerneljasonxing@gmail.com>

xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices

This commit attempts to fix a warning triggered in skb_checksum_help()
by AF_XDP pure-fragment SKBs. It rejects sw-csum UMEM binding for
drivers advertising IFF_TX_SKB_NO_LINEAR at setup time.

Closes: https://lore.kernel.org/all/20260419045822.843BFC2BCAF@smtp.kernel.org/#t
Fixes: 30c3055f9c0d ("xsk: wrap generic metadata handling onto separate function")
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Jason Xing <kernelxing@tencent.com>

> diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
> index cd7bc50872f6b5..d981cfdd853578 100644
> --- a/net/xdp/xsk_buff_pool.c
> +++ b/net/xdp/xsk_buff_pool.c
> @@ -175,6 +175,9 @@ int xp_assign_dev(struct xsk_buff_pool *pool,
>  	if (force_zc && force_copy)
>  		return -EINVAL;
>  
> +	if (pool->tx_sw_csum && (netdev->priv_flags & IFF_TX_SKB_NO_LINEAR))
> +		return -EOPNOTSUPP;
> +

Does this still leave a path for the warning in skb_checksum_help() to
trigger if hardware checksum offloading is disabled at runtime?

If a user sets XDP_TXMD_FLAGS_CHECKSUM on an IFF_TX_SKB_NO_LINEAR device,
and hardware checksum offload is later disabled (e.g., via ethtool -K
eth0 tx off), the core stack's validate_xmit_skb() will take over.

Because NETIF_F_SG can remain active even without checksum features,
skb_needs_linearize() evaluates to false, leaving the SKB unlinearized.

The SKB is then passed to skb_csum_hwoffload_help() which falls back to
skb_checksum_help(). Since the pure-fragment SKB still has a headlen of 0,
won't this hit the exact same WARN_ON_ONCE(offset >= skb_headlen(skb))
warning?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260424053816.27965-1-kerneljasonxing@gmail.com?part=1