Re: [PATCH net-next v2 04/15] net: skbuff: fail segmentation when a segment can't be checksummed

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 10/21/26 3:46 PM, Josef Bacik wrote:
> When the device can't checksum the protocol, skb_segment() computes
> each segment's checksum in software with skb_checksum().  With SG on,
> the segments share the original frags, and a devmem TCP skb keeps its
> whole payload in unreadable frags.  The devmem MSG_ZEROCOPY path never
> sets SKBFL_SHARED_FRAG, so the __skb_linearize() fallback is skipped
> too.  skb_checksum() then warns and returns 0, and tcp_gso_segment()
> writes a TCP checksum that doesn't cover the payload that goes out.
> 
> That's reachable with tx-checksumming off and SG on: sk_setup_caps()
> still gives TCP SG and HW_CSUM, so the dmabuf send is accepted, and
> harmonize_features() strips the checksum features but keeps SG.
> 
> Use skb_checksum_full() and fail the segmentation with -EFAULT when it
> can't checksum a segment, as skb_segment() already does when it can't
> copy one.
> 
> Found by the Sashiko AI review of an earlier fix for the same path with
> SG off.
> 
> Link: https://lore.kernel.org/all/20261009-b4-skb-segment-nosg-unreadable-v1-1-7e2334a55fe8@toxicpanda.com/
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> ---

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>

Thanks!

>   net/core/skbuff.c | 10 +++++++---
>   1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 40d2dd20d47d..88ed2dd99dc0 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -5239,9 +5239,13 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
>   
>   			if (!nskb->remcsum_offload)
>   				nskb->ip_summed = CHECKSUM_NONE;
> -			SKB_GSO_CB(nskb)->csum =
> -				skb_checksum(nskb, doffset,
> -					     nskb->len - doffset, 0);
> +			SKB_GSO_CB(nskb)->csum = 0;
> +			if (skb_checksum_full(nskb, doffset,
> +					      nskb->len - doffset,
> +					      &SKB_GSO_CB(nskb)->csum)) {
> +				err = -EFAULT;
> +				goto err;
> +			}
>   			SKB_GSO_CB(nskb)->csum_start =
>   				skb_headroom(nskb) + doffset;
>   		}
>