Re: [PATCH net-next 2/8] net: reserve extra TX headroom for local egress

[Tianyi Gao <tianyi@cloudflare.com>]

On Sun, Nov 08, 2026 at 03:35:12AM +0000, sashiko-bot@kernel.org wrote:
> [Severity: High]
> This problem wasn't introduced by this patch, but can hr + csum_start
> overflow the u16 skb->csum_start field in xsk_skb_metadata() [1]?

[ ... ]

> When a UMEM is registered with chunk_size equal to PAGE_SIZE on a 64KB
> page kernel (or with a large headroom reservation), desc->len can be up to
> 65536 and hr + csum_start can exceed U16_MAX while still passing the
> desc->len check.  Truncating the sum into skb->csum_start wraps it below
> skb_headroom(skb), making skb_checksum_start_offset() negative and
> triggering skb_dump() and WARN_ONCE() in skb_checksum_help() or passing a
> malformed skb to the driver in validate_xmit_skb().

This is a pre-existing issue, not introduced by this series.

Jason already planned to fix it [2][3], but it has been five months.

Jason, are you still planning to send the fix? If not, I can send it
to net.

[2] https://lore.kernel.org/all/CAL+tcoCp19F2rNxYL_LoGsY5MuBZ6cGKSZsj6D7kvQZcYp0wJg@mail.gmail.com/
[3] https://lore.kernel.org/all/CAL+tcoCgXG5MdPVzXavwMwk=jmPXgcB5aKpLK+TNXMVrsGmS9w@mail.gmail.com/