From: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
To: Josef Bacik <josef@toxicpanda.com>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@kernel.org>,
Jakub Kicinski <kuba@kernel.org>,
Paolo Abeni <pabeni@redhat.com>,
Simon Horman <horms@kernel.org>,
Andrew Lunn <andrew+netdev@lunn.ch>
Cc: Juergen Gross <jgross@suse.com>,
Stefano Stabellini <sstabellini@kernel.org>,
Willem de Bruijn <willemdebruijn.kernel@gmail.com>,
Fernando Fernandez Mancera <fmancera@suse.de>,
Mina Almasry <almasrymina@google.com>,
David Laight <david.laight.linux@gmail.com>,
netdev@vger.kernel.org, xen-devel@lists.xenproject.org,
Josef Bacik <josef@toxicpanda.com>
Subject: Re: [PATCH net-next 12/15] net: test the frag_list layouts skb_segment() refuses
Date: Tue, 20 Oct 2026 16:17:39 -0400 [thread overview]
Message-ID: <willemdebruijn.kernel.22d6042aad0ba@gmail.com> (raw)
In-Reply-To: <20261019-b4-skbuff-bug-on-followups-v1-12-41dbef50b9f7@toxicpanda.com>
Josef Bacik wrote:
> The GSO KUnit test only checks layouts skb_segment() can segment. Add
> two it has to refuse with -EINVAL: the non-uniform frag_list with SG
> on, which used to hit the BUG_ON(i >= nfrags) the existing test steps
> around, and a frag_list member that has its own frag_list.
>
> Both warn on CONFIG_DEBUG_NET kernels, so run them with the warning
> backtrace suppressed.
>
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Thanks!
> ---
> net/core/net_test.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 48 insertions(+)
>
> diff --git a/net/core/net_test.c b/net/core/net_test.c
> index bc2ef7612e7d..12a175268a01 100644
> --- a/net/core/net_test.c
> +++ b/net/core/net_test.c
> @@ -39,6 +39,8 @@ enum gso_test_nr {
> GSO_TEST_RESEGMENT_MULTI,
> GSO_TEST_RESEGMENT_TAIL,
> GSO_TEST_RESEGMENT_ONE_MSS,
> + GSO_TEST_FRAG_LIST_NON_UNIFORM_SG,
> + GSO_TEST_FRAG_LIST_NESTED,
> };
>
> struct gso_test_case {
> @@ -57,6 +59,9 @@ struct gso_test_case {
> unsigned int nr_segs;
> const unsigned int *segs;
> const unsigned int *gso_segs;
> +
> + /* skb_segment() is expected to fail with this error */
> + int err;
> };
>
> static struct gso_test_case cases[] = {
> @@ -204,6 +209,28 @@ static struct gso_test_case cases[] = {
> },
> .gso_segs = (const unsigned int[]) { 0, 0, 0, 0 },
> },
> + {
> + /* frag_list members that don't end on gso_size boundaries
> + * can't be segmented with SG
> + */
> + .id = GSO_TEST_FRAG_LIST_NON_UNIFORM_SG,
> + .name = "frag_list_non_uniform_sg",
> + .linear_len = GSO_TEST_SIZE,
> + .nr_frag_skbs = 4,
> + .frag_skbs = (const unsigned int[]) { GSO_TEST_SIZE, 1, GSO_TEST_SIZE, 2 },
> + .err = -EINVAL,
> + },
> + {
> + /* the second frag_list member hangs off the first one's
> + * frag_list instead of off the head's
> + */
> + .id = GSO_TEST_FRAG_LIST_NESTED,
> + .name = "frag_list_nested",
> + .linear_len = GSO_TEST_SIZE,
> + .nr_frag_skbs = 2,
> + .frag_skbs = (const unsigned int[]) { GSO_TEST_SIZE, GSO_TEST_SIZE },
> + .err = -EINVAL,
> + },
> };
>
> static void gso_test_case_to_desc(struct gso_test_case *t, char *desc)
> @@ -283,6 +310,15 @@ static void gso_test_func(struct kunit *test)
>
> if (tcase->id == GSO_TEST_GSO_BY_FRAGS)
> skb_shinfo(skb)->gso_size = GSO_BY_FRAGS;
> +
> + if (tcase->id == GSO_TEST_FRAG_LIST_NESTED) {
> + struct sk_buff *first = skb_shinfo(skb)->frag_list;
> +
> + skb_shinfo(first)->frag_list = first->next;
> + first->next = NULL;
> + first->len += tcase->frag_skbs[1];
> + first->data_len += tcase->frag_skbs[1];
> + }
> }
>
> features = NETIF_F_SG | NETIF_F_HW_CSUM;
> @@ -296,6 +332,18 @@ static void gso_test_func(struct kunit *test)
> features &= ~NETIF_F_SG;
>
> SKB_GSO_CB(skb)->max_segs = tcase->max_segs;
> +
> + if (tcase->err) {
> + /* the suppression block doesn't run if it can't be set up */
> + segs = NULL;
> + kunit_warning_suppress(test)
> + segs = skb_segment(skb, features);
nit: if respinning, add braces
> + KUNIT_EXPECT_EQ(test, PTR_ERR_OR_ZERO(segs), tcase->err);
> + if (!IS_ERR_OR_NULL(segs))
> + kfree_skb_list(segs);
> + goto free_gso_skb;
> + }
> +
> segs = skb_segment(skb, features);
> if (IS_ERR(segs)) {
> KUNIT_FAIL(test, "segs error %pe", segs);
>
> --
> 2.55.0
>
next prev parent reply other threads:[~2026-10-20 20:17 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-19 13:50 [PATCH net-next 00/15] net: skbuff: follow-ups to the BUG_ON() removal Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 01/15] net: skbuff: make skb_copy_and_csum_bits() report unreadable frags Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 02/15] net: skbuff: add skb_checksum_full() that reports failure Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 03/15] net: skbuff: fail checksum validation when the skb can't be checksummed Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 04/15] net: skbuff: fail segmentation when a segment " Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 05/15] net: skbuff: fail pskb_trim_rcsum() when it can't checksum the tail Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 06/15] net: skbuff: add skb_crc32c_full() that reports failure Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 07/15] net: skbuff: let skb_zerocopy() copy a short skb without head_frag Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 08/15] net: skbuff: make skb_try_coalesce()'s len unsigned Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 09/15] net: skbuff: check csum_start against len in skb_copy_and_csum_dev() Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 10/15] net: skbuff: reject a negative length in skb_copy_and_csum_bits() Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 11/15] net: skbuff: refuse to segment a nested frag_list Josef Bacik
2026-10-20 20:09 ` Willem de Bruijn
2026-10-19 13:50 ` [PATCH net-next 12/15] net: test the frag_list layouts skb_segment() refuses Josef Bacik
2026-10-20 20:17 ` Willem de Bruijn [this message]
2026-10-19 13:50 ` [PATCH net-next 13/15] xen-netfront: don't BUG() when skb_copy_bits() fails in bounce_skb() Josef Bacik
2026-10-19 13:50 ` [PATCH net-next 14/15] net/tls: don't BUG() on leftover length in __skb_nsg() Josef Bacik
2026-10-19 15:12 ` Mina Almasry
2026-10-19 16:22 ` Willem de Bruijn
2026-10-19 16:27 ` Mina Almasry
2026-10-19 13:50 ` [PATCH net-next 15/15] net: update comments that still describe the skb BUG_ON()s Josef Bacik
2026-10-19 15:09 ` Mina Almasry
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=willemdebruijn.kernel.22d6042aad0ba@gmail.com \
--to=willemdebruijn.kernel@gmail.com \
--cc=almasrymina@google.com \
--cc=andrew+netdev@lunn.ch \
--cc=davem@davemloft.net \
--cc=david.laight.linux@gmail.com \
--cc=edumazet@kernel.org \
--cc=fmancera@suse.de \
--cc=horms@kernel.org \
--cc=jgross@suse.com \
--cc=josef@toxicpanda.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sstabellini@kernel.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox