Re: [PATCH net] openvswitch: fix GSO userspace truncation underflow

[Ilya Maximets <i.maximets@ovn.org>]

On 7/8/26 12:16 AM, Kyle Zeng wrote:
> OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb
> length in OVS_CB(skb)->cutlen. When a later userspace action segments a
> GSO skb, queue_gso_packets() reuses that delta for each smaller segment.
> A segment can then reach queue_userspace_packet() with cutlen greater
> than skb->len, underflowing the length passed to skb_zerocopy().
> 
> Store the maximum preserved length instead and bound each consumer
> against the current skb length. Use U32_MAX as the no-truncation
> sentinel so the value remains valid if skb geometry changes before a
> consumer handles it.
> 
> Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> ---

Thanks, Kyle!  For the future, please, don't skip the general networking
maintainers and the ovs dev list while sending openvswitch -related patches.

Otherwise, this patch looks good to me:

Reviewed-by: Ilya Maximets <i.maximets@ovn.org>