Re: [PATCH net v4] net: skbuff: propagate shared-frag marker through frag-transfer helpers

[Aaron Esau <aaron1esau@gmail.com>]

skb_segment() propagates SKBFL_SHARED_FRAG from head_skb only.  When
segments pull frags from frag_list members, the flag is never
propagated from those members into the segment skb.

There are two miss sites:

1. Line ~4986: a new nskb propagates only from head_skb, but frag_skb
   may already point to a list_skb carried over from the previous
   segment's iteration (i, nfrags, frag_skb persist across the outer
   do/while).

2. When the inner loop exhausts head_skb frags and switches to a
   list_skb (line ~4999-5002), frag_skb is updated but its
   SKBFL_SHARED_FRAG is not propagated into nskb.

Your v4 GRO fix means head_skb will normally carry the flag, so
skb_segment() picks it up indirectly.  But skb_segment() itself should
propagate from frag_list members directly --- otherwise any non-GRO
frag_list producer re-exposes the gap.

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4986,7 +4986,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
 
-		skb_shinfo(nskb)->flags |= skb_shinfo(head_skb)->flags &
-					   SKBFL_SHARED_FRAG;
+		skb_shinfo(nskb)->flags |= (skb_shinfo(head_skb)->flags |
+					    skb_shinfo(frag_skb)->flags) &
+					   SKBFL_SHARED_FRAG;
 
 		if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC))
@@ -5000,6 +5001,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
 				frag = skb_shinfo(list_skb)->frags;
 				frag_skb = list_skb;
 
+				skb_shinfo(nskb)->flags |= skb_shinfo(frag_skb)->flags & SKBFL_SHARED_FRAG;
+
 				if (!skb_headlen(list_skb)) {
 					BUG_ON(!nfrags);
 				} else {

Site 1 covers segments that start mid-list_skb (frag_skb carried from
the previous segment).  Site 2 covers segments that switch from
head_skb frags to list_skb frags mid-construction.

Fixes: cef401de7be8 ("net: fix possible wrong checksum generation")