From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev, Zihan Xi <zihanx@nebusec.ai>,
netdev@vger.kernel.org
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
davem@davemloft.net, edumazet@google.com, pabeni@redhat.com,
horms@kernel.org, steffen.klassert@secunet.com,
herbert@gondor.apana.org.au, kerneljasonxing@gmail.com,
kuniyu@google.com, bjorn@kernel.org, bigeasy@linutronix.de,
jiayuan.chen@linux.dev, willemb@google.com, jlayton@kernel.org,
gustavoars@kernel.org, michael.bommarito@gmail.com,
runyu.xiao@seu.edu.cn, kees@kernel.org, lirongqing@baidu.com,
vega@nebusec.ai, zihanx@nebusec.ai
Subject: Re: [PATCH net 1/1] net: skbuff: reject skb header offset updates that truncate
Date: Fri, 31 Jul 2026 15:07:32 +0300 [thread overview]
Message-ID: <202607310427.nc6P5oqS-lkp@intel.com> (raw)
In-Reply-To: <06ac032651d91cfe4b2e246f6fc36e3d4b2f87d1.1785346409.git.zihanx@nebusec.ai>
Hi Zihan,
kernel test robot noticed the following build warnings:
url: https://github.com/intel-lab-lkp/linux/commits/Zihan-Xi/net-skbuff-reject-skb-header-offset-updates-that-truncate/20260730-175139
base: net/main
patch link: https://lore.kernel.org/r/06ac032651d91cfe4b2e246f6fc36e3d4b2f87d1.1785346409.git.zihanx%40nebusec.ai
patch subject: [PATCH net 1/1] net: skbuff: reject skb header offset updates that truncate
config: i386-randconfig-141-20260730 (https://download.01.org/0day-ci/archive/20260731/202607310427.nc6P5oqS-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607310427.nc6P5oqS-lkp@intel.com/
New smatch warnings:
net/core/skbuff.c:5208 skb_segment() warn: passing zero to 'ERR_PTR'
vim +/ERR_PTR +5208 net/core/skbuff.c
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 4855 struct sk_buff *skb_segment(struct sk_buff *head_skb,
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 4856 netdev_features_t features)
f4c50d990dcf11a Herbert Xu 2006-06-22 4857 {
f4c50d990dcf11a Herbert Xu 2006-06-22 4858 struct sk_buff *segs = NULL;
f4c50d990dcf11a Herbert Xu 2006-06-22 4859 struct sk_buff *tail = NULL;
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 4860 struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list;
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 4861 unsigned int mss = skb_shinfo(head_skb)->gso_size;
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 4862 unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
f4c50d990dcf11a Herbert Xu 2006-06-22 4863 unsigned int offset = doffset;
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 4864 unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
802ab55adc39a06 Alexander Duyck 2016-04-10 4865 unsigned int partial_segs = 0;
f4c50d990dcf11a Herbert Xu 2006-06-22 4866 unsigned int headroom;
802ab55adc39a06 Alexander Duyck 2016-04-10 4867 unsigned int len = head_skb->len;
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4868 struct sk_buff *frag_skb;
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4869 skb_frag_t *frag;
ec5f06156423889 Pravin B Shelar 2013-03-07 4870 __be16 proto;
36c983824b6f17b Alexander Duyck 2016-05-02 4871 bool csum, sg;
f4c50d990dcf11a Herbert Xu 2006-06-22 4872 int err = -ENOMEM;
This is set to -ENOMEM but it doesn't work
f4c50d990dcf11a Herbert Xu 2006-06-22 4873 int i = 0;
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4874 int nfrags, pos;
f4c50d990dcf11a Herbert Xu 2006-06-22 4875
9e4b7a99a03aefd Jiri Benc 2022-11-02 4876 if ((skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY) &&
9e4b7a99a03aefd Jiri Benc 2022-11-02 4877 mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb)) {
9e4b7a99a03aefd Jiri Benc 2022-11-02 4878 struct sk_buff *check_skb;
9e4b7a99a03aefd Jiri Benc 2022-11-02 4879
9e4b7a99a03aefd Jiri Benc 2022-11-02 4880 for (check_skb = list_skb; check_skb; check_skb = check_skb->next) {
9e4b7a99a03aefd Jiri Benc 2022-11-02 4881 if (skb_headlen(check_skb) && !check_skb->head_frag) {
9e4b7a99a03aefd Jiri Benc 2022-11-02 4882 /* gso_size is untrusted, and we have a frag_list with
9e4b7a99a03aefd Jiri Benc 2022-11-02 4883 * a linear non head_frag item.
3dcbdb134f32984 Shmulik Ladkani 2019-09-06 4884 *
9e4b7a99a03aefd Jiri Benc 2022-11-02 4885 * If head_skb's headlen does not fit requested gso_size,
9e4b7a99a03aefd Jiri Benc 2022-11-02 4886 * it means that the frag_list members do NOT terminate
9e4b7a99a03aefd Jiri Benc 2022-11-02 4887 * on exact gso_size boundaries. Hence we cannot perform
9e4b7a99a03aefd Jiri Benc 2022-11-02 4888 * skb_frag_t page sharing. Therefore we must fallback to
9e4b7a99a03aefd Jiri Benc 2022-11-02 4889 * copying the frag_list skbs; we do so by disabling SG.
3dcbdb134f32984 Shmulik Ladkani 2019-09-06 4890 */
3dcbdb134f32984 Shmulik Ladkani 2019-09-06 4891 features &= ~NETIF_F_SG;
9e4b7a99a03aefd Jiri Benc 2022-11-02 4892 break;
9e4b7a99a03aefd Jiri Benc 2022-11-02 4893 }
9e4b7a99a03aefd Jiri Benc 2022-11-02 4894 }
3dcbdb134f32984 Shmulik Ladkani 2019-09-06 4895 }
3dcbdb134f32984 Shmulik Ladkani 2019-09-06 4896
5882a07c72093dc Wei-Chun Chao 2014-06-08 4897 __skb_push(head_skb, doffset);
2f631133c40cd8e Miaohe Lin 2020-08-01 4898 proto = skb_network_protocol(head_skb, NULL);
ec5f06156423889 Pravin B Shelar 2013-03-07 4899 if (unlikely(!proto))
ec5f06156423889 Pravin B Shelar 2013-03-07 4900 return ERR_PTR(-EINVAL);
ec5f06156423889 Pravin B Shelar 2013-03-07 4901
36c983824b6f17b Alexander Duyck 2016-05-02 4902 sg = !!(features & NETIF_F_SG);
f245d079c1d11dc Alexander Duyck 2016-02-05 4903 csum = !!can_checksum_protocol(features, proto);
7e2b10c1e52ca37 Tom Herbert 2014-06-04 4904
07b26c9454a2a19 Steffen Klassert 2016-09-19 4905 if (sg && csum && (mss != GSO_BY_FRAGS)) {
07b26c9454a2a19 Steffen Klassert 2016-09-19 4906 if (!(features & NETIF_F_GSO_PARTIAL)) {
07b26c9454a2a19 Steffen Klassert 2016-09-19 4907 struct sk_buff *iter;
43170c4e0ba709c Ilan Tayari 2017-04-19 4908 unsigned int frag_len;
07b26c9454a2a19 Steffen Klassert 2016-09-19 4909
07b26c9454a2a19 Steffen Klassert 2016-09-19 4910 if (!list_skb ||
07b26c9454a2a19 Steffen Klassert 2016-09-19 4911 !net_gso_ok(features, skb_shinfo(head_skb)->gso_type))
07b26c9454a2a19 Steffen Klassert 2016-09-19 4912 goto normal;
07b26c9454a2a19 Steffen Klassert 2016-09-19 4913
43170c4e0ba709c Ilan Tayari 2017-04-19 4914 /* If we get here then all the required
43170c4e0ba709c Ilan Tayari 2017-04-19 4915 * GSO features except frag_list are supported.
43170c4e0ba709c Ilan Tayari 2017-04-19 4916 * Try to split the SKB to multiple GSO SKBs
43170c4e0ba709c Ilan Tayari 2017-04-19 4917 * with no frag_list.
43170c4e0ba709c Ilan Tayari 2017-04-19 4918 * Currently we can do that only when the buffers don't
43170c4e0ba709c Ilan Tayari 2017-04-19 4919 * have a linear part and all the buffers except
43170c4e0ba709c Ilan Tayari 2017-04-19 4920 * the last are of the same length.
07b26c9454a2a19 Steffen Klassert 2016-09-19 4921 */
43170c4e0ba709c Ilan Tayari 2017-04-19 4922 frag_len = list_skb->len;
07b26c9454a2a19 Steffen Klassert 2016-09-19 4923 skb_walk_frags(head_skb, iter) {
43170c4e0ba709c Ilan Tayari 2017-04-19 4924 if (frag_len != iter->len && iter->next)
43170c4e0ba709c Ilan Tayari 2017-04-19 4925 goto normal;
eaffadbbb3f2711 Ilan Tayari 2017-04-08 4926 if (skb_headlen(iter) && !iter->head_frag)
07b26c9454a2a19 Steffen Klassert 2016-09-19 4927 goto normal;
07b26c9454a2a19 Steffen Klassert 2016-09-19 4928
07b26c9454a2a19 Steffen Klassert 2016-09-19 4929 len -= iter->len;
07b26c9454a2a19 Steffen Klassert 2016-09-19 4930 }
43170c4e0ba709c Ilan Tayari 2017-04-19 4931
43170c4e0ba709c Ilan Tayari 2017-04-19 4932 if (len != frag_len)
43170c4e0ba709c Ilan Tayari 2017-04-19 4933 goto normal;
07b26c9454a2a19 Steffen Klassert 2016-09-19 4934 }
07b26c9454a2a19 Steffen Klassert 2016-09-19 4935
802ab55adc39a06 Alexander Duyck 2016-04-10 4936 /* GSO partial only requires that we trim off any excess that
802ab55adc39a06 Alexander Duyck 2016-04-10 4937 * doesn't fit into an MSS sized block, so take care of that
802ab55adc39a06 Alexander Duyck 2016-04-10 4938 * now.
23d05d563b7e7b0 Eric Dumazet 2023-12-12 4939 * Cap len to not accidentally hit GSO_BY_FRAGS.
802ab55adc39a06 Alexander Duyck 2016-04-10 4940 */
23d05d563b7e7b0 Eric Dumazet 2023-12-12 4941 partial_segs = min(len, GSO_BY_FRAGS - 1) / mss;
d7fb5a80492169c Alexander Duyck 2016-05-02 4942 if (partial_segs > 1)
802ab55adc39a06 Alexander Duyck 2016-04-10 4943 mss *= partial_segs;
d7fb5a80492169c Alexander Duyck 2016-05-02 4944 else
d7fb5a80492169c Alexander Duyck 2016-05-02 4945 partial_segs = 0;
802ab55adc39a06 Alexander Duyck 2016-04-10 4946 }
802ab55adc39a06 Alexander Duyck 2016-04-10 4947
07b26c9454a2a19 Steffen Klassert 2016-09-19 4948 normal:
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 4949 headroom = skb_headroom(head_skb);
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 4950 pos = skb_headlen(head_skb);
f4c50d990dcf11a Herbert Xu 2006-06-22 4951
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4952 if (skb_orphan_frags(head_skb, GFP_ATOMIC))
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4953 return ERR_PTR(-ENOMEM);
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4954
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4955 nfrags = skb_shinfo(head_skb)->nr_frags;
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4956 frag = skb_shinfo(head_skb)->frags;
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4957 frag_skb = head_skb;
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4958
f4c50d990dcf11a Herbert Xu 2006-06-22 4959 do {
because we're in a do while loop.
f4c50d990dcf11a Herbert Xu 2006-06-22 4960 struct sk_buff *nskb;
8cb19905e9287a9 Michael S. Tsirkin 2014-03-10 4961 skb_frag_t *nskb_frag;
c8884edd0787489 Herbert Xu 2006-10-29 4962 int hsize;
f4c50d990dcf11a Herbert Xu 2006-06-22 4963 int size;
f4c50d990dcf11a Herbert Xu 2006-06-22 4964
3953c46c3ac7eef Marcelo Ricardo Leitner 2016-06-02 4965 if (unlikely(mss == GSO_BY_FRAGS)) {
3953c46c3ac7eef Marcelo Ricardo Leitner 2016-06-02 4966 len = list_skb->len;
3953c46c3ac7eef Marcelo Ricardo Leitner 2016-06-02 4967 } else {
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 4968 len = head_skb->len - offset;
f4c50d990dcf11a Herbert Xu 2006-06-22 4969 if (len > mss)
f4c50d990dcf11a Herbert Xu 2006-06-22 4970 len = mss;
3953c46c3ac7eef Marcelo Ricardo Leitner 2016-06-02 4971 }
f4c50d990dcf11a Herbert Xu 2006-06-22 4972
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 4973 hsize = skb_headlen(head_skb) - offset;
f4c50d990dcf11a Herbert Xu 2006-06-22 4974
dbd50f238decfe5 Xin Long 2021-01-15 4975 if (hsize <= 0 && i >= nfrags && skb_headlen(list_skb) &&
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 4976 (skb_headlen(list_skb) == len || sg)) {
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 4977 BUG_ON(skb_headlen(list_skb) > len);
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4978
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4979 nskb = skb_clone(list_skb, GFP_ATOMIC);
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4980 if (unlikely(!nskb))
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4981 goto err;
So on the second iteration "err" is zero.
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 4982
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4983 i = 0;
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 4984 nfrags = skb_shinfo(list_skb)->nr_frags;
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 4985 frag = skb_shinfo(list_skb)->frags;
1fd819ecb90cc9b Michael S. Tsirkin 2014-03-10 4986 frag_skb = list_skb;
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 4987 pos += skb_headlen(list_skb);
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4988
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4989 while (pos < offset + len) {
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4990 BUG_ON(i >= nfrags);
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4991
4e1beba12d094c6 Michael S. Tsirkin 2014-03-10 4992 size = skb_frag_size(frag);
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4993 if (pos + size > offset + len)
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4994 break;
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4995
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4996 i++;
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4997 pos += size;
4e1beba12d094c6 Michael S. Tsirkin 2014-03-10 4998 frag++;
9d8506cc2d7ea1f Herbert Xu 2013-11-21 4999 }
89319d3801d1d3a Herbert Xu 2008-12-15 5000
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 5001 list_skb = list_skb->next;
89319d3801d1d3a Herbert Xu 2008-12-15 5002
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5003 if (unlikely(pskb_trim(nskb, len))) {
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5004 kfree_skb(nskb);
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5005 goto err;
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5006 }
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5007
ec47ea824774046 Alexander Duyck 2012-05-04 5008 hsize = skb_end_offset(nskb);
89319d3801d1d3a Herbert Xu 2008-12-15 5009 if (skb_cow_head(nskb, doffset + headroom)) {
89319d3801d1d3a Herbert Xu 2008-12-15 5010 kfree_skb(nskb);
89319d3801d1d3a Herbert Xu 2008-12-15 5011 goto err;
89319d3801d1d3a Herbert Xu 2008-12-15 5012 }
89319d3801d1d3a Herbert Xu 2008-12-15 5013
ec47ea824774046 Alexander Duyck 2012-05-04 5014 nskb->truesize += skb_end_offset(nskb) - hsize;
89319d3801d1d3a Herbert Xu 2008-12-15 5015 skb_release_head_state(nskb);
89319d3801d1d3a Herbert Xu 2008-12-15 5016 __skb_push(nskb, doffset);
89319d3801d1d3a Herbert Xu 2008-12-15 5017 } else {
00b229f762b020e Paolo Abeni 2021-01-19 5018 if (hsize < 0)
00b229f762b020e Paolo Abeni 2021-01-19 5019 hsize = 0;
dbd50f238decfe5 Xin Long 2021-01-15 5020 if (hsize > len || !sg)
dbd50f238decfe5 Xin Long 2021-01-15 5021 hsize = len;
dbd50f238decfe5 Xin Long 2021-01-15 5022
c93bdd0e03e8485 Mel Gorman 2012-07-31 5023 nskb = __alloc_skb(hsize + doffset + headroom,
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 5024 GFP_ATOMIC, skb_alloc_rx_flag(head_skb),
c93bdd0e03e8485 Mel Gorman 2012-07-31 5025 NUMA_NO_NODE);
89319d3801d1d3a Herbert Xu 2008-12-15 5026
89319d3801d1d3a Herbert Xu 2008-12-15 5027 if (unlikely(!nskb))
89319d3801d1d3a Herbert Xu 2008-12-15 5028 goto err;
89319d3801d1d3a Herbert Xu 2008-12-15 5029
89319d3801d1d3a Herbert Xu 2008-12-15 5030 skb_reserve(nskb, headroom);
89319d3801d1d3a Herbert Xu 2008-12-15 5031 __skb_put(nskb, doffset);
89319d3801d1d3a Herbert Xu 2008-12-15 5032 }
89319d3801d1d3a Herbert Xu 2008-12-15 5033
f4c50d990dcf11a Herbert Xu 2006-06-22 5034 if (segs)
f4c50d990dcf11a Herbert Xu 2006-06-22 5035 tail->next = nskb;
f4c50d990dcf11a Herbert Xu 2006-06-22 5036 else
f4c50d990dcf11a Herbert Xu 2006-06-22 5037 segs = nskb;
f4c50d990dcf11a Herbert Xu 2006-06-22 5038 tail = nskb;
f4c50d990dcf11a Herbert Xu 2006-06-22 5039
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 5040 __copy_skb_header(nskb, head_skb);
f4c50d990dcf11a Herbert Xu 2006-06-22 5041
b0cf97975a1cf81 Zihan Xi 2026-07-29 5042 err = skb_headers_offset_update_careful(nskb, skb_headroom(nskb) - headroom);
b0cf97975a1cf81 Zihan Xi 2026-07-29 5043 if (unlikely(err))
b0cf97975a1cf81 Zihan Xi 2026-07-29 5044 goto err;
fcdfe3a7fa4cb74 Vlad Yasevich 2014-07-31 5045 skb_reset_mac_len(nskb);
68c331631143f5f Pravin B Shelar 2013-02-14 5046
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 5047 skb_copy_from_linear_data_offset(head_skb, -tnl_hlen,
68c331631143f5f Pravin B Shelar 2013-02-14 5048 nskb->data - tnl_hlen,
68c331631143f5f Pravin B Shelar 2013-02-14 5049 doffset + tnl_hlen);
89319d3801d1d3a Herbert Xu 2008-12-15 5050
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5051 if (nskb->len == len + doffset)
1cdbcb7957cf9e5 Simon Horman 2013-05-19 5052 goto perform_csum_check;
89319d3801d1d3a Herbert Xu 2008-12-15 5053
7fbeffed77c130e Alexander Duyck 2016-02-05 5054 if (!sg) {
1454c9fa9106584 Yadu Kishore 2020-03-17 5055 if (!csum) {
7fbeffed77c130e Alexander Duyck 2016-02-05 5056 if (!nskb->remcsum_offload)
6f85a124d819e1c Herbert Xu 2008-08-15 5057 nskb->ip_summed = CHECKSUM_NONE;
764434562270971 Alexander Duyck 2016-02-05 5058 SKB_GSO_CB(nskb)->csum =
764434562270971 Alexander Duyck 2016-02-05 5059 skb_copy_and_csum_bits(head_skb, offset,
1454c9fa9106584 Yadu Kishore 2020-03-17 5060 skb_put(nskb,
1454c9fa9106584 Yadu Kishore 2020-03-17 5061 len),
8d5930dfb7edbf1 Al Viro 2020-07-10 5062 len);
7e2b10c1e52ca37 Tom Herbert 2014-06-04 5063 SKB_GSO_CB(nskb)->csum_start =
de843723f9b9891 Tom Herbert 2014-06-25 5064 skb_headroom(nskb) + doffset;
1454c9fa9106584 Yadu Kishore 2020-03-17 5065 } else {
c624c58e08b1510 lily 2022-08-22 5066 if (skb_copy_bits(head_skb, offset, skb_put(nskb, len), len))
c624c58e08b1510 lily 2022-08-22 5067 goto err;
1454c9fa9106584 Yadu Kishore 2020-03-17 5068 }
f4c50d990dcf11a Herbert Xu 2006-06-22 5069 continue;
f4c50d990dcf11a Herbert Xu 2006-06-22 5070 }
f4c50d990dcf11a Herbert Xu 2006-06-22 5071
8cb19905e9287a9 Michael S. Tsirkin 2014-03-10 5072 nskb_frag = skb_shinfo(nskb)->frags;
f4c50d990dcf11a Herbert Xu 2006-06-22 5073
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 5074 skb_copy_from_linear_data_offset(head_skb, offset,
d626f62b11e00c1 Arnaldo Carvalho de Melo 2007-03-27 5075 skb_put(nskb, hsize), hsize);
f4c50d990dcf11a Herbert Xu 2006-06-22 5076
48f6a5356a33dd7 Hyunwoo Kim 2026-05-16 5077 skb_shinfo(nskb)->flags |= (skb_shinfo(head_skb)->flags |
48f6a5356a33dd7 Hyunwoo Kim 2026-05-16 5078 skb_shinfo(frag_skb)->flags) &
06b4feb37e64e54 Jonathan Lemon 2021-01-06 5079 SKBFL_SHARED_FRAG;
cef401de7be8c4e Eric Dumazet 2013-01-25 5080
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 5081 if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC))
bf5c25d608613ea Willem de Bruijn 2017-12-22 5082 goto err;
bf5c25d608613ea Willem de Bruijn 2017-12-22 5083
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5084 while (pos < offset + len) {
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5085 if (i >= nfrags) {
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 5086 if (skb_orphan_frags(list_skb, GFP_ATOMIC) ||
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 5087 skb_zerocopy_clone(nskb, list_skb,
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 5088 GFP_ATOMIC))
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 5089 goto err;
2ea35288c83b3d5 Mohamed Khalfella 2023-08-31 5090
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5091 i = 0;
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 5092 nfrags = skb_shinfo(list_skb)->nr_frags;
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 5093 frag = skb_shinfo(list_skb)->frags;
1fd819ecb90cc9b Michael S. Tsirkin 2014-03-10 5094 frag_skb = list_skb;
48f6a5356a33dd7 Hyunwoo Kim 2026-05-16 5095
48f6a5356a33dd7 Hyunwoo Kim 2026-05-16 5096 skb_shinfo(nskb)->flags |= skb_shinfo(frag_skb)->flags & SKBFL_SHARED_FRAG;
48f6a5356a33dd7 Hyunwoo Kim 2026-05-16 5097
13acc94eff122b2 Yonghong Song 2018-03-21 5098 if (!skb_headlen(list_skb)) {
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5099 BUG_ON(!nfrags);
13acc94eff122b2 Yonghong Song 2018-03-21 5100 } else {
13acc94eff122b2 Yonghong Song 2018-03-21 5101 BUG_ON(!list_skb->head_frag);
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5102
13acc94eff122b2 Yonghong Song 2018-03-21 5103 /* to make room for head_frag. */
13acc94eff122b2 Yonghong Song 2018-03-21 5104 i--;
13acc94eff122b2 Yonghong Song 2018-03-21 5105 frag--;
13acc94eff122b2 Yonghong Song 2018-03-21 5106 }
bf5c25d608613ea Willem de Bruijn 2017-12-22 5107
1a4cedaf65491e6 Michael S. Tsirkin 2014-03-10 5108 list_skb = list_skb->next;
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5109 }
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5110
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5111 if (unlikely(skb_shinfo(nskb)->nr_frags >=
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5112 MAX_SKB_FRAGS)) {
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5113 net_warn_ratelimited(
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5114 "skb_segment: too many frags: %u %u\n",
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5115 pos, mss);
ff907a11a0d68a7 Eric Dumazet 2018-07-19 5116 err = -EINVAL;
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5117 goto err;
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5118 }
9d8506cc2d7ea1f Herbert Xu 2013-11-21 5119
13acc94eff122b2 Yonghong Song 2018-03-21 5120 *nskb_frag = (i < 0) ? skb_head_frag_to_page_desc(frag_skb) : *frag;
173e7622ccb3f46 Mina Almasry 2024-05-02 5121 __skb_frag_ref(nskb_frag);
8cb19905e9287a9 Michael S. Tsirkin 2014-03-10 5122 size = skb_frag_size(nskb_frag);
f4c50d990dcf11a Herbert Xu 2006-06-22 5123
f4c50d990dcf11a Herbert Xu 2006-06-22 5124 if (pos < offset) {
b54c9d5bd6e38ed Jonathan Lemon 2019-07-30 5125 skb_frag_off_add(nskb_frag, offset - pos);
8cb19905e9287a9 Michael S. Tsirkin 2014-03-10 5126 skb_frag_size_sub(nskb_frag, offset - pos);
f4c50d990dcf11a Herbert Xu 2006-06-22 5127 }
f4c50d990dcf11a Herbert Xu 2006-06-22 5128
89319d3801d1d3a Herbert Xu 2008-12-15 5129 skb_shinfo(nskb)->nr_frags++;
f4c50d990dcf11a Herbert Xu 2006-06-22 5130
f4c50d990dcf11a Herbert Xu 2006-06-22 5131 if (pos + size <= offset + len) {
f4c50d990dcf11a Herbert Xu 2006-06-22 5132 i++;
4e1beba12d094c6 Michael S. Tsirkin 2014-03-10 5133 frag++;
f4c50d990dcf11a Herbert Xu 2006-06-22 5134 pos += size;
f4c50d990dcf11a Herbert Xu 2006-06-22 5135 } else {
8cb19905e9287a9 Michael S. Tsirkin 2014-03-10 5136 skb_frag_size_sub(nskb_frag, pos + size - (offset + len));
89319d3801d1d3a Herbert Xu 2008-12-15 5137 goto skip_fraglist;
f4c50d990dcf11a Herbert Xu 2006-06-22 5138 }
f4c50d990dcf11a Herbert Xu 2006-06-22 5139
8cb19905e9287a9 Michael S. Tsirkin 2014-03-10 5140 nskb_frag++;
f4c50d990dcf11a Herbert Xu 2006-06-22 5141 }
f4c50d990dcf11a Herbert Xu 2006-06-22 5142
89319d3801d1d3a Herbert Xu 2008-12-15 5143 skip_fraglist:
f4c50d990dcf11a Herbert Xu 2006-06-22 5144 nskb->data_len = len - hsize;
f4c50d990dcf11a Herbert Xu 2006-06-22 5145 nskb->len += nskb->data_len;
f4c50d990dcf11a Herbert Xu 2006-06-22 5146 nskb->truesize += nskb->data_len;
ec5f06156423889 Pravin B Shelar 2013-03-07 5147
1cdbcb7957cf9e5 Simon Horman 2013-05-19 5148 perform_csum_check:
7fbeffed77c130e Alexander Duyck 2016-02-05 5149 if (!csum) {
ff907a11a0d68a7 Eric Dumazet 2018-07-19 5150 if (skb_has_shared_frag(nskb) &&
ff907a11a0d68a7 Eric Dumazet 2018-07-19 5151 __skb_linearize(nskb))
ddff00d420432d5 Alexander Duyck 2016-02-05 5152 goto err;
ff907a11a0d68a7 Eric Dumazet 2018-07-19 5153
7fbeffed77c130e Alexander Duyck 2016-02-05 5154 if (!nskb->remcsum_offload)
ec5f06156423889 Pravin B Shelar 2013-03-07 5155 nskb->ip_summed = CHECKSUM_NONE;
764434562270971 Alexander Duyck 2016-02-05 5156 SKB_GSO_CB(nskb)->csum =
764434562270971 Alexander Duyck 2016-02-05 5157 skb_checksum(nskb, doffset,
764434562270971 Alexander Duyck 2016-02-05 5158 nskb->len - doffset, 0);
7e2b10c1e52ca37 Tom Herbert 2014-06-04 5159 SKB_GSO_CB(nskb)->csum_start =
7e2b10c1e52ca37 Tom Herbert 2014-06-04 5160 skb_headroom(nskb) + doffset;
ec5f06156423889 Pravin B Shelar 2013-03-07 5161 }
df5771ffefb13f8 Michael S. Tsirkin 2014-03-10 5162 } while ((offset += len) < head_skb->len);
f4c50d990dcf11a Herbert Xu 2006-06-22 5163
bec3cfdca36bf43 Eric Dumazet 2014-10-03 5164 /* Some callers want to get the end of the list.
bec3cfdca36bf43 Eric Dumazet 2014-10-03 5165 * Put it in segs->prev to avoid walking the list.
bec3cfdca36bf43 Eric Dumazet 2014-10-03 5166 * (see validate_xmit_skb_list() for example)
bec3cfdca36bf43 Eric Dumazet 2014-10-03 5167 */
bec3cfdca36bf43 Eric Dumazet 2014-10-03 5168 segs->prev = tail;
432c856fcf45c46 Toshiaki Makita 2014-10-27 5169
802ab55adc39a06 Alexander Duyck 2016-04-10 5170 if (partial_segs) {
07b26c9454a2a19 Steffen Klassert 2016-09-19 5171 struct sk_buff *iter;
802ab55adc39a06 Alexander Duyck 2016-04-10 5172 int type = skb_shinfo(head_skb)->gso_type;
07b26c9454a2a19 Steffen Klassert 2016-09-19 5173 unsigned short gso_size = skb_shinfo(head_skb)->gso_size;
802ab55adc39a06 Alexander Duyck 2016-04-10 5174
802ab55adc39a06 Alexander Duyck 2016-04-10 5175 /* Update type to add partial and then remove dodgy if set */
07b26c9454a2a19 Steffen Klassert 2016-09-19 5176 type |= (features & NETIF_F_GSO_PARTIAL) / NETIF_F_GSO_PARTIAL * SKB_GSO_PARTIAL;
802ab55adc39a06 Alexander Duyck 2016-04-10 5177 type &= ~SKB_GSO_DODGY;
802ab55adc39a06 Alexander Duyck 2016-04-10 5178
802ab55adc39a06 Alexander Duyck 2016-04-10 5179 /* Update GSO info and prepare to start updating headers on
802ab55adc39a06 Alexander Duyck 2016-04-10 5180 * our way back down the stack of protocols.
802ab55adc39a06 Alexander Duyck 2016-04-10 5181 */
07b26c9454a2a19 Steffen Klassert 2016-09-19 5182 for (iter = segs; iter; iter = iter->next) {
07b26c9454a2a19 Steffen Klassert 2016-09-19 5183 skb_shinfo(iter)->gso_size = gso_size;
07b26c9454a2a19 Steffen Klassert 2016-09-19 5184 skb_shinfo(iter)->gso_segs = partial_segs;
07b26c9454a2a19 Steffen Klassert 2016-09-19 5185 skb_shinfo(iter)->gso_type = type;
07b26c9454a2a19 Steffen Klassert 2016-09-19 5186 SKB_GSO_CB(iter)->data_offset = skb_headroom(iter) + doffset;
07b26c9454a2a19 Steffen Klassert 2016-09-19 5187 }
07b26c9454a2a19 Steffen Klassert 2016-09-19 5188
07b26c9454a2a19 Steffen Klassert 2016-09-19 5189 if (tail->len - doffset <= gso_size)
07b26c9454a2a19 Steffen Klassert 2016-09-19 5190 skb_shinfo(tail)->gso_size = 0;
07b26c9454a2a19 Steffen Klassert 2016-09-19 5191 else if (tail != segs)
07b26c9454a2a19 Steffen Klassert 2016-09-19 5192 skb_shinfo(tail)->gso_segs = DIV_ROUND_UP(tail->len - doffset, gso_size);
802ab55adc39a06 Alexander Duyck 2016-04-10 5193 }
802ab55adc39a06 Alexander Duyck 2016-04-10 5194
432c856fcf45c46 Toshiaki Makita 2014-10-27 5195 /* Following permits correct backpressure, for protocols
432c856fcf45c46 Toshiaki Makita 2014-10-27 5196 * using skb_set_owner_w().
432c856fcf45c46 Toshiaki Makita 2014-10-27 5197 * Idea is to tranfert ownership from head_skb to last segment.
432c856fcf45c46 Toshiaki Makita 2014-10-27 5198 */
432c856fcf45c46 Toshiaki Makita 2014-10-27 5199 if (head_skb->destructor == sock_wfree) {
432c856fcf45c46 Toshiaki Makita 2014-10-27 5200 swap(tail->truesize, head_skb->truesize);
432c856fcf45c46 Toshiaki Makita 2014-10-27 5201 swap(tail->destructor, head_skb->destructor);
432c856fcf45c46 Toshiaki Makita 2014-10-27 5202 swap(tail->sk, head_skb->sk);
432c856fcf45c46 Toshiaki Makita 2014-10-27 5203 }
f4c50d990dcf11a Herbert Xu 2006-06-22 5204 return segs;
f4c50d990dcf11a Herbert Xu 2006-06-22 5205
f4c50d990dcf11a Herbert Xu 2006-06-22 5206 err:
289dccbe141e01e Eric Dumazet 2013-12-20 5207 kfree_skb_list(segs);
f4c50d990dcf11a Herbert Xu 2006-06-22 @5208 return ERR_PTR(err);
f4c50d990dcf11a Herbert Xu 2006-06-22 5209 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
prev parent reply other threads:[~2026-08-04 12:10 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-29 18:40 [PATCH net 0/1] net: skbuff: reject skb header offset updates that truncate Zihan Xi
2026-07-29 18:40 ` [PATCH net 1/1] " Zihan Xi
2026-07-31 2:10 ` Jakub Kicinski
2026-07-31 12:07 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202607310427.nc6P5oqS-lkp@intel.com \
--to=error27@gmail.com \
--cc=bigeasy@linutronix.de \
--cc=bjorn@kernel.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=gustavoars@kernel.org \
--cc=herbert@gondor.apana.org.au \
--cc=horms@kernel.org \
--cc=jiayuan.chen@linux.dev \
--cc=jlayton@kernel.org \
--cc=kees@kernel.org \
--cc=kerneljasonxing@gmail.com \
--cc=kuniyu@google.com \
--cc=lirongqing@baidu.com \
--cc=lkp@intel.com \
--cc=michael.bommarito@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
--cc=pabeni@redhat.com \
--cc=runyu.xiao@seu.edu.cn \
--cc=steffen.klassert@secunet.com \
--cc=vega@nebusec.ai \
--cc=willemb@google.com \
--cc=zihanx@nebusec.ai \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox