[PATCH net-next 0/3] net: gso: fix MTU validation of BIG TCP jumbograms

[PATCH net-next 0/3] net: gso: fix MTU validation of BIG TCP jumbograms

[Mariusz Klimek]

This series fixes the MTU validation of BIG TCP jumbograms and removes the
existing IP6SKB_FAKEJUMBO work-around that only fixes the issue in one
location.

For GSO packets, the length that matters for MTU validation is the segment
length, not the total length of the packet. skb_gso_network_seglen is used
by skb_gso_validate_network_len to calculate the segment length including
the network and transport headers and to then verify that the segment
length is below the MTU.

skb_gso_network_seglen assumes that the headers of the segments are
identical to those of the unsegmented packet, but that assumption is
incorrect for BIG TCP jumbograms which have an added HBH header that is
removed upon segmentation. The calculated segment length ends up being 8
bytes more than the actual segment length.

The actual segment length is set according to the MSS, so the segment
length calculated by skb_gso_network_seglen is greater than the MTU,
causing the skb_gso_validate_network_len check to fail despite the fact
that the actual segment length is lower than the MTU.

There is currently a work-around that fixes this bug in some cases:
ip6_xmit sets the IP6SKB_FAKEJUMBO flag for BIG TCP jumbograms, which
causes the MTU validation in ip6_finish_output_gso to be skipped
(intentionally). However, this work-around doesn't apply to MTU validations
performed in other places such as in ip6_forward. BIG TCP jumbograms don't
pass the MTU validation when forwarded locally and are therefore dropped,
unless the MTU of the originating interface is lower than the MTUs of the
rest of the interfaces the packets are forwarded through.

Mariusz Klimek (3):
  net: gso: do not include jumbogram HBH header in seglen calculation
  ipv6: remove IP6SKB_FAKEJUMBO flag
  selftests/net: remove unnecessary MTU config in big_tcp.sh

 include/linux/ipv6.h                   | 1 -
 net/core/gso.c                         | 4 ++++
 net/ipv6/ip6_output.c                  | 4 +---
 tools/testing/selftests/net/big_tcp.sh | 1 -
 4 files changed, 5 insertions(+), 5 deletions(-)

-- 
2.47.3

[PATCH net-next 1/3] net: gso: do not include jumbogram HBH header in seglen calculation

[Mariusz Klimek]

This patch fixes an issue in skb_gso_network_seglen where the calculated
segment length includes the HBH headers of BIG TCP jumbograms despite these
headers being removed before segmentation. These headers are added by GRO
or by ip6_xmit for BIG TCP packets and are later removed by GSO. This bug
causes MTU validation of BIG TCP jumbograms to fail.

Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>
---
 net/core/gso.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/core/gso.c b/net/core/gso.c
index bcd156372f4d..251a49181031 100644
--- a/net/core/gso.c
+++ b/net/core/gso.c
@@ -180,6 +180,10 @@ static unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
 	unsigned int hdr_len = skb_transport_header(skb) -
 			       skb_network_header(skb);
 
+	/* Jumbogram HBH header is removed upon segmentation. */
+	if (skb->protocol == htons(ETH_P_IPV6) && skb->len > IPV6_MAXPLEN)
+		hdr_len -= sizeof(struct hop_jumbo_hdr);
+
 	return hdr_len + skb_gso_transport_seglen(skb);
 }
 
-- 
2.47.3

Re: [PATCH net-next 1/3] net: gso: do not include jumbogram HBH header in seglen calculation

[Paolo Abeni]

On 11/27/25 10:13 AM, Mariusz Klimek wrote:
> This patch fixes an issue in skb_gso_network_seglen where the calculated
> segment length includes the HBH headers of BIG TCP jumbograms despite these
> headers being removed before segmentation. These headers are added by GRO
> or by ip6_xmit for BIG TCP packets and are later removed by GSO. This bug
> causes MTU validation of BIG TCP jumbograms to fail.
> 
> Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>
> ---
>  net/core/gso.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/net/core/gso.c b/net/core/gso.c
> index bcd156372f4d..251a49181031 100644
> --- a/net/core/gso.c
> +++ b/net/core/gso.c
> @@ -180,6 +180,10 @@ static unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
>  	unsigned int hdr_len = skb_transport_header(skb) -
>  			       skb_network_header(skb);
>  
> +	/* Jumbogram HBH header is removed upon segmentation. */
> +	if (skb->protocol == htons(ETH_P_IPV6) && skb->len > IPV6_MAXPLEN)
> +		hdr_len -= sizeof(struct hop_jumbo_hdr);

Isn't the above condition a bit too course-grain? Specifically, can
UDP-encapsulated GSO packets wrongly hit it?

/P

Re: [PATCH net-next 1/3] net: gso: do not include jumbogram HBH header in seglen calculation

[Paolo Abeni]

On 12/2/25 12:36 PM, Paolo Abeni wrote:
> On 11/27/25 10:13 AM, Mariusz Klimek wrote:
>> This patch fixes an issue in skb_gso_network_seglen where the calculated
>> segment length includes the HBH headers of BIG TCP jumbograms despite these
>> headers being removed before segmentation. These headers are added by GRO
>> or by ip6_xmit for BIG TCP packets and are later removed by GSO. This bug
>> causes MTU validation of BIG TCP jumbograms to fail.
>>
>> Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>
>> ---
>>  net/core/gso.c | 4 ++++
>>  1 file changed, 4 insertions(+)
>>
>> diff --git a/net/core/gso.c b/net/core/gso.c
>> index bcd156372f4d..251a49181031 100644
>> --- a/net/core/gso.c
>> +++ b/net/core/gso.c
>> @@ -180,6 +180,10 @@ static unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
>>  	unsigned int hdr_len = skb_transport_header(skb) -
>>  			       skb_network_header(skb);
>>  
>> +	/* Jumbogram HBH header is removed upon segmentation. */
>> +	if (skb->protocol == htons(ETH_P_IPV6) && skb->len > IPV6_MAXPLEN)
>> +		hdr_len -= sizeof(struct hop_jumbo_hdr);
> 
> Isn't the above condition a bit too course-grain? Specifically, can
> UDP-encapsulated GSO packets wrongly hit it?

I forgot to mention that AI review noted the above check should be
placed in skb_gso_mac_seglen(), too:

https://netdev-ai.bots.linux.dev/ai-review.html?id=bed04a62-0239-4392-a9a3-2399fee27630

AFAICS, it the OVS forwarding path should be impacted.

/P

Re: [PATCH net-next 1/3] net: gso: do not include jumbogram HBH header in seglen calculation

[Mariusz Klimek]

On 12/2/25 13:06, Paolo Abeni wrote:
> On 12/2/25 12:36 PM, Paolo Abeni wrote:
>> On 11/27/25 10:13 AM, Mariusz Klimek wrote:
>>> This patch fixes an issue in skb_gso_network_seglen where the calculated
>>> segment length includes the HBH headers of BIG TCP jumbograms despite these
>>> headers being removed before segmentation. These headers are added by GRO
>>> or by ip6_xmit for BIG TCP packets and are later removed by GSO. This bug
>>> causes MTU validation of BIG TCP jumbograms to fail.
>>>
>>> Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>
>>> ---
>>>  net/core/gso.c | 4 ++++
>>>  1 file changed, 4 insertions(+)
>>>
>>> diff --git a/net/core/gso.c b/net/core/gso.c
>>> index bcd156372f4d..251a49181031 100644
>>> --- a/net/core/gso.c
>>> +++ b/net/core/gso.c
>>> @@ -180,6 +180,10 @@ static unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
>>>  	unsigned int hdr_len = skb_transport_header(skb) -
>>>  			       skb_network_header(skb);
>>>  
>>> +	/* Jumbogram HBH header is removed upon segmentation. */
>>> +	if (skb->protocol == htons(ETH_P_IPV6) && skb->len > IPV6_MAXPLEN)
>>> +		hdr_len -= sizeof(struct hop_jumbo_hdr);
>>
>> Isn't the above condition a bit too course-grain? Specifically, can
>> UDP-encapsulated GSO packets wrongly hit it?
> 
> I forgot to mention that AI review noted the above check should be
> placed in skb_gso_mac_seglen(), too:
> 
> https://netdev-ai.bots.linux.dev/ai-review.html?id=bed04a62-0239-4392-a9a3-2399fee27630
> 
> AFAICS, it the OVS forwarding path should be impacted.
> 
> /P
> 

Right. I'll add a helper function.

-- 
Mariusz K.

Re: [PATCH net-next 1/3] net: gso: do not include jumbogram HBH header in seglen calculation

[Mariusz Klimek]

On 12/2/25 12:36, Paolo Abeni wrote:
> On 11/27/25 10:13 AM, Mariusz Klimek wrote:
>> This patch fixes an issue in skb_gso_network_seglen where the calculated
>> segment length includes the HBH headers of BIG TCP jumbograms despite these
>> headers being removed before segmentation. These headers are added by GRO
>> or by ip6_xmit for BIG TCP packets and are later removed by GSO. This bug
>> causes MTU validation of BIG TCP jumbograms to fail.
>>
>> Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>
>> ---
>>  net/core/gso.c | 4 ++++
>>  1 file changed, 4 insertions(+)
>>
>> diff --git a/net/core/gso.c b/net/core/gso.c
>> index bcd156372f4d..251a49181031 100644
>> --- a/net/core/gso.c
>> +++ b/net/core/gso.c
>> @@ -180,6 +180,10 @@ static unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
>>  	unsigned int hdr_len = skb_transport_header(skb) -
>>  			       skb_network_header(skb);
>>  
>> +	/* Jumbogram HBH header is removed upon segmentation. */
>> +	if (skb->protocol == htons(ETH_P_IPV6) && skb->len > IPV6_MAXPLEN)
>> +		hdr_len -= sizeof(struct hop_jumbo_hdr);
> 
> Isn't the above condition a bit too course-grain? Specifically, can
> UDP-encapsulated GSO packets wrongly hit it?
> 
> /P
> 

You're right. Also, It should actually be skb->len - nhdr_len where nhdr_len is
the length from the beginning of the packet up to right after the network header.

Should I send a new version or wait for net-next to re-open?

-- 
Mariusz K.

Re: [PATCH net-next 1/3] net: gso: do not include jumbogram HBH header in seglen calculation

[Paolo Abeni]

On 12/2/25 5:41 PM, Mariusz Klimek wrote:
> On 12/2/25 12:36, Paolo Abeni wrote:
>> On 11/27/25 10:13 AM, Mariusz Klimek wrote:
>>> This patch fixes an issue in skb_gso_network_seglen where the calculated
>>> segment length includes the HBH headers of BIG TCP jumbograms despite these
>>> headers being removed before segmentation. These headers are added by GRO
>>> or by ip6_xmit for BIG TCP packets and are later removed by GSO. This bug
>>> causes MTU validation of BIG TCP jumbograms to fail.
>>>
>>> Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>
>>> ---
>>>  net/core/gso.c | 4 ++++
>>>  1 file changed, 4 insertions(+)
>>>
>>> diff --git a/net/core/gso.c b/net/core/gso.c
>>> index bcd156372f4d..251a49181031 100644
>>> --- a/net/core/gso.c
>>> +++ b/net/core/gso.c
>>> @@ -180,6 +180,10 @@ static unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
>>>  	unsigned int hdr_len = skb_transport_header(skb) -
>>>  			       skb_network_header(skb);
>>>  
>>> +	/* Jumbogram HBH header is removed upon segmentation. */
>>> +	if (skb->protocol == htons(ETH_P_IPV6) && skb->len > IPV6_MAXPLEN)
>>> +		hdr_len -= sizeof(struct hop_jumbo_hdr);
>>
>> Isn't the above condition a bit too course-grain? Specifically, can
>> UDP-encapsulated GSO packets wrongly hit it?
> 
> You're right. Also, It should actually be skb->len - nhdr_len where nhdr_len is
> the length from the beginning of the packet up to right after the network header.
> 
> Should I send a new version or wait for net-next to re-open?

You need to wait for net-next to re-open. Please note that due to the
unfortunated calendar (conferences and EoY) this could be longer than usual.

All the information will be shared on the ML, as usual.

/P

[PATCH net-next 2/3] ipv6: remove IP6SKB_FAKEJUMBO flag

[Mariusz Klimek]

This patch removes the IP6SKB_FAKEJUMBO flag that is used as a work-around
to bypass MTU validation of BIG TCP jumbograms due to a bug in
skb_gso_network_seglen. This work-around is no longer required now that the
bug is fixed.

Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>
---
 include/linux/ipv6.h  | 1 -
 net/ipv6/ip6_output.c | 4 +---
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 7294e4e89b79..9f076171106e 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -155,7 +155,6 @@ struct inet6_skb_parm {
 #define IP6SKB_L3SLAVE         64
 #define IP6SKB_JUMBOGRAM      128
 #define IP6SKB_SEG6	      256
-#define IP6SKB_FAKEJUMBO      512
 #define IP6SKB_MULTIPATH      1024
 #define IP6SKB_MCROUTE        2048
 };
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index f904739e99b9..9af9ec6bdb8c 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -179,8 +179,7 @@ ip6_finish_output_gso_slowpath_drop(struct net *net, struct sock *sk,
 static int ip6_finish_output_gso(struct net *net, struct sock *sk,
 				 struct sk_buff *skb, unsigned int mtu)
 {
-	if (!(IP6CB(skb)->flags & IP6SKB_FAKEJUMBO) &&
-	    !skb_gso_validate_network_len(skb, mtu))
+	if (!skb_gso_validate_network_len(skb, mtu))
 		return ip6_finish_output_gso_slowpath_drop(net, sk, skb, mtu);
 
 	return ip6_finish_output2(net, sk, skb);
@@ -323,7 +322,6 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
 
 		proto = IPPROTO_HOPOPTS;
 		seg_len = 0;
-		IP6CB(skb)->flags |= IP6SKB_FAKEJUMBO;
 	}
 
 	skb_push(skb, sizeof(struct ipv6hdr));
-- 
2.47.3

[PATCH net-next 3/3] selftests/net: remove unnecessary MTU config in big_tcp.sh

[Mariusz Klimek]

This patch removes the manual lowering of the client MTU in big_tcp.sh. The
MTU lowering was previously required as a work-around due to a bug in the
MTU validation of BIG TCP jumbograms. The MTU was lowered to 1442, but note
that 1492 (1500 - 8) would of worked just as well. Now that the bug has
been fixed, the manual client MTU modification can be removed entirely.

Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>
---
 tools/testing/selftests/net/big_tcp.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/testing/selftests/net/big_tcp.sh b/tools/testing/selftests/net/big_tcp.sh
index 2db9d15cd45f..b5d9145296d3 100755
--- a/tools/testing/selftests/net/big_tcp.sh
+++ b/tools/testing/selftests/net/big_tcp.sh
@@ -32,7 +32,6 @@ setup() {
 	ip -net $ROUTER_NS link add link2 type veth peer name link3 netns $SERVER_NS
 
 	ip -net $CLIENT_NS link set link0 up
-	ip -net $CLIENT_NS link set link0 mtu 1442
 	ip -net $CLIENT_NS addr add $CLIENT_IP4/24 dev link0
 	ip -net $CLIENT_NS addr add $CLIENT_IP6/64 dev link0 nodad
 	ip -net $CLIENT_NS route add $SERVER_IP4 dev link0 via $CLIENT_GW4
-- 
2.47.3

Re: [PATCH net-next 3/3] selftests/net: remove unnecessary MTU config in big_tcp.sh

[Paolo Abeni]

On 11/27/25 10:13 AM, Mariusz Klimek wrote:
> This patch removes the manual lowering of the client MTU in big_tcp.sh. The
> MTU lowering was previously required as a work-around due to a bug in the
> MTU validation of BIG TCP jumbograms. The MTU was lowered to 1442, but note
> that 1492 (1500 - 8) would of worked just as well. Now that the bug has
> been fixed, the manual client MTU modification can be removed entirely.
> 
> Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>

While touching this self-tests, I think it would be nice to additionally
add the 'negative' case, i.e. egress mtu lower than ingress and bit tcp
segmentation taking place.

/P

Re: [PATCH net-next 3/3] selftests/net: remove unnecessary MTU config in big_tcp.sh

[Mariusz Klimek]

On 12/2/25 13:01, Paolo Abeni wrote:
> On 11/27/25 10:13 AM, Mariusz Klimek wrote:
>> This patch removes the manual lowering of the client MTU in big_tcp.sh. The
>> MTU lowering was previously required as a work-around due to a bug in the
>> MTU validation of BIG TCP jumbograms. The MTU was lowered to 1442, but note
>> that 1492 (1500 - 8) would of worked just as well. Now that the bug has
>> been fixed, the manual client MTU modification can be removed entirely.
>>
>> Signed-off-by: Mariusz Klimek <maklimek97@gmail.com>
> 
> While touching this self-tests, I think it would be nice to additionally
> add the 'negative' case, i.e. egress mtu lower than ingress and bit tcp
> segmentation taking place.
> 
> /P
> 

Good idea. I'll update the tests.

-- 
Mariusz K.