[PATCH net] net: ip_gre: use checksum-aware trim for ERSPAN

[PATCH net] net: ip_gre: use checksum-aware trim for ERSPAN

[Kenneth Lee]

ERSPAN currently uses pskb_trim() when truncating packets to the device
MTU.  For a CHECKSUM_PARTIAL skb, that helper can leave csum_start and
csum_offset pointing at a checksum field outside the new packet length.
The skb can then reach skb_checksum_help() during transmit validation,
which warns when the checksum offset is beyond skb_headlen().

Use pskb_trim_rcsum() in both ERSPAN transmit paths.  It rejects a
CHECKSUM_PARTIAL skb whose checksum field is no longer in the trimmed
linear data and returns -EINVAL.  The existing error paths then free the
skb instead of transmitting inconsistent checksum metadata.

Fixes: f192970de860 ("ip_gre: check packet length and mtu correctly in erspan tx")

Found-by: Sechang Lim <rhkrqnwk98@gmail.com>
Signed-off-by: Kenneth Lee <kennethbwlee@snu.ac.kr>
---
 net/ipv4/ip_gre.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 169e2921a851..16f80620f6d1 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -576,7 +576,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
 		goto err_free_skb;
 
 	if (skb->len > dev->mtu + dev->hard_header_len) {
-		if (pskb_trim(skb, dev->mtu + dev->hard_header_len))
+		if (pskb_trim_rcsum(skb, dev->mtu + dev->hard_header_len))
 			goto err_free_skb;
 		truncate = true;
 	}
@@ -723,7 +723,7 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
 		goto free_skb;
 
 	if (skb->len > dev->mtu + dev->hard_header_len) {
-		if (pskb_trim(skb, dev->mtu + dev->hard_header_len))
+		if (pskb_trim_rcsum(skb, dev->mtu + dev->hard_header_len))
 			goto free_skb;
 		truncate = true;
 	}
-- 
2.53.0

Re: [PATCH net] net: ip_gre: use checksum-aware trim for ERSPAN

[Antoine Tenart]

On Thu, Jul 30, 2026 at 05:52:20PM +0900, Kenneth Lee wrote:
> ERSPAN currently uses pskb_trim() when truncating packets to the device
> MTU.  For a CHECKSUM_PARTIAL skb, that helper can leave csum_start and
> csum_offset pointing at a checksum field outside the new packet length.
> The skb can then reach skb_checksum_help() during transmit validation,
> which warns when the checksum offset is beyond skb_headlen().
> 
> Use pskb_trim_rcsum() in both ERSPAN transmit paths.  It rejects a
> CHECKSUM_PARTIAL skb whose checksum field is no longer in the trimmed
> linear data and returns -EINVAL.  The existing error paths then free the
> skb instead of transmitting inconsistent checksum metadata.

Can you include a description of the MTU and kind of packet that
triggers this?

> Fixes: f192970de860 ("ip_gre: check packet length and mtu correctly in erspan tx")
> 

Extra empty line.

Wasn't pskb_trim called before this commit?

> Found-by: Sechang Lim <rhkrqnwk98@gmail.com>

This is not a known tag,
https://docs.kernel.org/process/submitting-patches.html#using-reported-by-tested-by-reviewed-by-suggested-by-and-fixes

(You should used Reported-by: here).

> Signed-off-by: Kenneth Lee <kennethbwlee@snu.ac.kr>
> ---
>  net/ipv4/ip_gre.c | 4 ++--

Looks like the IPv6 counterpart has the same construction, can you
check?

>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
> index 169e2921a851..16f80620f6d1 100644
> --- a/net/ipv4/ip_gre.c
> +++ b/net/ipv4/ip_gre.c
> @@ -576,7 +576,7 @@ static void erspan_fb_xmit(struct sk_buff *skb, struct net_device *dev)
>  		goto err_free_skb;
>  
>  	if (skb->len > dev->mtu + dev->hard_header_len) {
> -		if (pskb_trim(skb, dev->mtu + dev->hard_header_len))
> +		if (pskb_trim_rcsum(skb, dev->mtu + dev->hard_header_len))
>  			goto err_free_skb;
>  		truncate = true;
>  	}
> @@ -723,7 +723,7 @@ static netdev_tx_t erspan_xmit(struct sk_buff *skb,
>  		goto free_skb;
>  
>  	if (skb->len > dev->mtu + dev->hard_header_len) {
> -		if (pskb_trim(skb, dev->mtu + dev->hard_header_len))
> +		if (pskb_trim_rcsum(skb, dev->mtu + dev->hard_header_len))
>  			goto free_skb;
>  		truncate = true;
>  	}
> -- 
> 2.53.0
> 

Re: [PATCH net] net: ip_gre: use checksum-aware trim for ERSPAN

[Kenneth Lee]

Hi Antoine,

> Can you include a description of the MTU and kind of packet that
> triggers this?

The triggering configuration uses the default erspan0 device, which has
an MTU of 1450 bytes. Since it is an Ethernet device, the trim limit is
dev->mtu + dev->hard_header_len, or 1450 + 14 = 1464 bytes.

The triggering traffic is a loopback of IPv4 TCP SYN. A tc BPF program
grows the skb with skb_adjust_room() before redirecting it. ERSPAN
subsequently trims the skb with pskb_trim(), which does not validate
the CHECKSUM_PARTIAL checksum location. The checksum metadata therefore
points beyond the new packet length and later triggers the following
warning:

  offset (4516) >= skb_headlen() (3730)
  WARNING: net/core/dev.c:3600 at skb_checksum_help+0x47b/0x7c

> Wasn't pskb_trim called before this commit?

You are right that pskb_trim() was already used before f192970de860.
That commit only changed the MTU and length accounting. A more
appropriate commit would be 84e54fe0a5ea, 1a66a836da63.

> Looks like the IPv6 counterpart has the same construction, can you
> check?

I checked the IPv6 counterpart and ip6erspan_tunnel_xmit() has the same
pskb_trim() construction. I'll post a following patch if I can
reproduce the same warning.

Lastly thanks for pointing out the extra empty line and tag.

Thanks,
Kenneth Lee