Re: [PATCH v2 net] ppp: linearize and segment bridged packets when required

[Simon Horman <horms@kernel.org>]

On Mon, Oct 26, 2026 at 04:59:27PM +0100, Eric Dumazet wrote:
> PPP channel bridging hands packets received on one channel directly to
> the start_xmit() of another. Packets received by PPPoE can be
> non-linear, GSO since commit 55a5d8fca836 ("net: pppoe: implement
> GRO/GSO support"), or CHECKSUM_PARTIAL when injected with a
> virtio_net_hdr. The regular transmit path never sees such packets, and
> only PPPoE, which uses dev_queue_xmit(), handles them:
> 
> - PPP Async reads the whole packet through skb->data, transmitting
>   unrelated memory for non-linear packets.
> - PPP Async and Sync send GSO packets as single frames of up to 64KB,
>   and CHECKSUM_PARTIAL packets with a bad L4 checksum.
> - PPTP and L2TP cannot segment a TCP GSO packet once their GRE or UDP
>   header is pushed, and do not finish pending checksums.
> 
> Add a xmit_offload flag to struct ppp_channel, set for PPPoE. For other
> channels, segment GSO packets in software, using the PPP protocol field
> as the L2 header, finish CHECKSUM_PARTIAL checksums (including SCTP
> CRC32c), and linearize packets for channels without direct_xmit, as
> ppp_push() does. Packets are dropped if any step fails, or if the
> channel is busy, as before.
> 
> skb->dev is NULL at this point for PPPoE (cleared by __sk_receive_skb()),
> and tunnel and IPv6 UFO GSO handlers dereference it: only TCP, UDP L4
> and fraglist GSO packets without encapsulation are segmented, others
> are dropped.
> 
> Receive paths like L2TP pull headers without updating the checksum
> state, possibly leaving a CHECKSUM_PARTIAL state with csum_start before
> skb->data. Reset it to CHECKSUM_NONE, as skb_postpull_rcsum() does, so
> that skb_checksum_help() does not warn, and so that PPPoE does not
> offload a checksum at a wrong offset.
> 
> Tested in a VM by bridging PPPoE (on a TAP with IFF_NAPI_FRAGS, or on
> veth) to PPP Async on a PTY, PPPoL2TP and PPPoE: non-linear packets no
> longer leak garbage, GSO packets (including fraglist GRO) are sent as
> valid segments for IPv4 and IPv6, CHECKSUM_PARTIAL packets get a valid
> checksum, and PPPoE still receives GSO packets unchanged.
> 
> Fixes: 4cf476ced45d ("ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls")
> Fixes: 55a5d8fca836 ("net: pppoe: implement GRO/GSO support")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260908072135.877364-1-qingfang.deng@linux.dev
> Co-developed-by: Qingfang Deng <qingfang.deng@linux.dev>
> Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> Cc: Felix Fietkau <nbd@nbd.name>
> Cc: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
> v2: addressed Sashiko feedback
>  - Only segment TCP, UDP_L4 and fraglist GSO skbs without encapsulation,
>    skb->dev is NULL here.
>  - Reset stale CHECKSUM_PARTIAL state with csum_start before skb->data.
>  - Use skb_csum_hwoffload_help(skb, 0) to handle SCTP CRC32c.
> v1: https://lore.kernel.org/netdev/20261022111039.85112-1-edumazet@kernel.org/

Reviewed-by: Simon Horman <horms@kernel.org>