[PATCH net] net: gso: fall back to skb_segment when fraglist cannot satisfy checksum

[PATCH net] net: gso: fall back to skb_segment when fraglist cannot satisfy checksum

[Willem de Bruijn]

From: Willem de Bruijn <willemb@google.com>

skb_segment_list() keeps the original transport headers and checksum
state of its frag_list members. It ignores the checksum bits in features
and does not initialize the SKB_GSO_CB() checksum state. This breaks in
two cases:

1. Outer tunnel checksums. __skb_udp_tunnel_segment() and
   gre_gso_segment() compute them with gso_make_checksum(), which
   reads SKB_GSO_CB() fields that hold stale skb->cb contents. The
   outer checksum also needs the inner payload sum, which
   skb_segment_list() does not compute.

2. CHECKSUM_PARTIAL packets, for example from veth or tun, sent to a
   device that cannot checksum them. skb_segment_list() does not fix
   this up, unlike skb_segment().

Fall back to more generic skb_segment() in these cases, as already done
for modified geometry and SKB_GSO_DODGY. Expand to when

- skb->encapsulation is set (IPIP, ESP)
- skb_tnl_header_len() is non-zero (UDP, GRE and MPLS tunnels)
- the features cannot checksum a CHECKSUM_PARTIAL packet.

skb_segment is a strict superset of skb_segment_list functionality.
This is always safe.

This also moves encapsulated packets that were handled correctly, such
as those in tunnels without outer checksums, to the slower
skb_segment() path. Fraglist GRO is off by default.

Discovered through analysis by an LLM. Reproduced on an unmodified
kernel and verified with LLM-generated reproducers in virtme-ng.

Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.")
Fixes: bee88cd5bd83 ("net: add support for segmenting TCP fraglist GSO packets")
Cc: stable@vger.kernel.org
Reported-by: Hassan Sultan <hassansultan@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
---
 net/ipv4/tcp_offload.c   | 5 ++++-
 net/ipv4/udp_offload.c   | 7 ++++++-
 net/ipv6/tcpv6_offload.c | 6 +++++-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index b84fcd07c723..127035ba4faa 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -108,7 +108,10 @@ static struct sk_buff *tcp4_gso_segment(struct sk_buff *skb,
 		struct tcphdr *th = tcp_hdr(skb);
 
 		if ((skb_pagelen(skb) - th->doff * 4 == skb_shinfo(skb)->gso_size) &&
-		    !(skb_shinfo(skb)->gso_type & SKB_GSO_DODGY))
+		    !(skb_shinfo(skb)->gso_type & SKB_GSO_DODGY) &&
+		    !skb->encapsulation && !skb_tnl_header_len(skb) &&
+		    (skb->ip_summed != CHECKSUM_PARTIAL ||
+		     can_checksum_protocol(features, htons(ETH_P_IP))))
 			return __tcp4_gso_segment_list(skb, features);
 
 		skb->ip_summed = CHECKSUM_NONE;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index cd9d7426b227..8e9610d35083 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -516,7 +516,12 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
 	if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) {
 		 /* Detect modified geometry and pass those to skb_segment. */
 		if ((skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size) &&
-		    !(skb_shinfo(gso_skb)->gso_type & SKB_GSO_DODGY))
+		    !(skb_shinfo(gso_skb)->gso_type & SKB_GSO_DODGY) &&
+		    !gso_skb->encapsulation && !skb_tnl_header_len(gso_skb) &&
+		    (gso_skb->ip_summed != CHECKSUM_PARTIAL ||
+		     can_checksum_protocol(features,
+					   is_ipv6 ? htons(ETH_P_IPV6) :
+						     htons(ETH_P_IP))))
 			return __udp_gso_segment_list(gso_skb, features, is_ipv6);
 
 		ret = __skb_linearize(gso_skb);
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index eec3778855eb..5b830d244660 100644
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -9,6 +9,7 @@
 #include <linux/skbuff.h>
 #include <net/inet6_hashtables.h>
 #include <net/gro.h>
+#include <net/gso.h>
 #include <net/protocol.h>
 #include <net/tcp.h>
 #include <net/ip6_checksum.h>
@@ -180,7 +181,10 @@ static struct sk_buff *tcp6_gso_segment(struct sk_buff *skb,
 		struct tcphdr *th = tcp_hdr(skb);
 
 		if ((skb_pagelen(skb) - th->doff * 4 == skb_shinfo(skb)->gso_size) &&
-		    !(skb_shinfo(skb)->gso_type & SKB_GSO_DODGY))
+		    !(skb_shinfo(skb)->gso_type & SKB_GSO_DODGY) &&
+		    !skb->encapsulation && !skb_tnl_header_len(skb) &&
+		    (skb->ip_summed != CHECKSUM_PARTIAL ||
+		     can_checksum_protocol(features, htons(ETH_P_IPV6))))
 			return __tcp6_gso_segment_list(skb, features);
 
 		skb->ip_summed = CHECKSUM_NONE;
-- 
2.56.0.567.gdb80ae8cd5-goog

Re: [PATCH net] net: gso: fall back to skb_segment when fraglist cannot satisfy checksum

[Jakub Kicinski]

On Wed, 11 Nov 2026 17:10:33 -0500 Willem de Bruijn wrote:
> skb_segment_list() keeps the original transport headers and checksum
> state of its frag_list members. It ignores the checksum bits in features
> and does not initialize the SKB_GSO_CB() checksum state. This breaks in
> two cases:

Does not apply?
-- 
pw-bot: cr