From: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
To: Josef Bacik <josef@toxicpanda.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@kernel.org>,
Jakub Kicinski <kuba@kernel.org>,
Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
Kaiyuan Zhang <kaiyuanz@google.com>,
Mina Almasry <almasrymina@google.com>,
Willem de Bruijn <willemb@google.com>
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
bpf@vger.kernel.org, Josef Bacik <josef@toxicpanda.com>
Subject: Re: [PATCH net-next 1/9] net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
Date: Wed, 07 Oct 2026 10:50:07 -0400 [thread overview]
Message-ID: <willemdebruijn.kernel.235bf1cecf85f@gmail.com> (raw)
In-Reply-To: <20261006-b4-skbuff-bug-on-v1-1-1b4434c5357c@toxicpanda.com>
Josef Bacik wrote:
> When skb_copy_and_csum_bits() reaches unreadable frags it returns 0
> after copying only the linear part, and the rest of the caller's buffer
> is left as it was. The callers copy into a buffer that is about to go
> out on the wire: an ICMP error quoting the offending packet, or a
> driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer
> is zeroed beforehand, so whatever was in memory there gets sent.
>
> Zero the part of the buffer we didn't fill. The checksum is already
> wrong in this case, so the packet still gets dropped by the receiver,
> it just doesn't carry anything it shouldn't. Only zero for a positive
> @len, a negative one from a broken caller must not turn into a huge
> memset().
>
> Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags")
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
This should be a stand-alone fix sent to net (and stable)?
next prev parent reply other threads:[~2026-10-07 14:50 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-06 17:10 [PATCH net-next 0/9] net: skbuff: convert most BUG_ON()s to WARN_ON_ONCE() and an error Josef Bacik
2026-10-06 17:10 ` [PATCH net-next 1/9] net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() Josef Bacik
2026-10-07 14:50 ` Willem de Bruijn [this message]
2026-10-07 17:11 ` sashiko-bot
2026-10-09 8:11 ` netdev-bot+sashiko
2026-10-06 17:10 ` [PATCH net-next 2/9] net: skbuff: don't BUG() on bad arguments to pskb_expand_head() Josef Bacik
2026-10-07 14:51 ` Willem de Bruijn
2026-10-06 17:10 ` [PATCH net-next 3/9] net: skbuff: don't BUG() on a bad frag_list layout in skb_segment() Josef Bacik
2026-10-09 8:12 ` netdev-bot+sashiko
2026-10-09 16:10 ` Mina Almasry
2026-10-06 17:10 ` [PATCH net-next 4/9] net: skbuff: don't BUG() when skb_copy_bits() fails in copy helpers Josef Bacik
2026-10-06 17:10 ` [PATCH net-next 5/9] net: skbuff: don't BUG() on leftover length in skb_checksum() and friends Josef Bacik
2026-10-09 8:12 ` netdev-bot+sashiko
2026-10-06 17:10 ` [PATCH net-next 6/9] net: skbuff: don't BUG() on a bad csum_start in skb_copy_and_csum_dev() Josef Bacik
2026-10-09 8:12 ` netdev-bot+sashiko
2026-10-06 17:10 ` [PATCH net-next 7/9] net: skbuff: don't BUG() on leftover length in skb_copy_and_csum_bits() Josef Bacik
2026-10-07 17:11 ` sashiko-bot
2026-10-09 8:12 ` netdev-bot+sashiko
2026-10-06 17:10 ` [PATCH net-next 8/9] net: skbuff: don't BUG() on a missing head_frag in skb_zerocopy() Josef Bacik
2026-10-09 8:12 ` netdev-bot+sashiko
2026-10-09 16:11 ` Mina Almasry
2026-10-06 17:10 ` [PATCH net-next 9/9] net: skbuff: remove the BUG_ON()s from skb_shift() Josef Bacik
2026-10-07 14:48 ` [PATCH net-next 0/9] net: skbuff: convert most BUG_ON()s to WARN_ON_ONCE() and an error Willem de Bruijn
2026-10-07 14:59 ` Fernando Fernandez Mancera
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=willemdebruijn.kernel.235bf1cecf85f@gmail.com \
--to=willemdebruijn.kernel@gmail.com \
--cc=almasrymina@google.com \
--cc=bpf@vger.kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@kernel.org \
--cc=horms@kernel.org \
--cc=josef@toxicpanda.com \
--cc=kaiyuanz@google.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox