RE: [PATCH net-next v2 10/10] net: skbuff: don't reset truesize in skb_condense() if the pull fails

["Loktionov, Aleksandr" <aleksandr.loktionov@xxxxxxxxx>]

> -----Original Message-----
> From: Josef Bacik <josef@xxxxxxxxxxxxxx>
> Sent: Thursday, October 8, 2026 11:03 PM
> To: Jakub Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni <pabeni@xxxxxxxxxx>;
> Eric Dumazet <edumazet@xxxxxxxxxx>; David S. Miller
> <davem@xxxxxxxxxxxxx>; Andrew Lunn <andrew+netdev@xxxxxxx>
> Cc: Saeed Mahameed <saeedm@xxxxxxxxxx>; Tariq Toukan
> <tariqt@xxxxxxxxxx>; Mark Bloch <mbloch@xxxxxxxxxx>; Leon Romanovsky
> <leon@xxxxxxxxxx>; Juergen Gross <jgross@xxxxxxxx>; Stefano Stabellini
> <sstabellini@xxxxxxxxxx>; Oleksandr Tyshchenko
> <oleksandr_tyshchenko@xxxxxxxx>; Nguyen, Anthony L
> <anthony.l.nguyen@xxxxxxxxx>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@xxxxxxxxx>; Manish Chopra <manishc@xxxxxxxxxxx>;
> Rahul Verma <rahulv@xxxxxxxxxxx>; GR-Linux-NIC-Dev@xxxxxxxxxxx; Shahed
> Shaikh <shshaikh@xxxxxxxxxxx>; Simon Horman <horms@xxxxxxxxxx>;
> netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; linux-
> rdma@xxxxxxxxxxxxxxx; xen-devel@xxxxxxxxxxxxxxxxxxxx; intel-wired-
> lan@xxxxxxxxxxxxxxxx; Josef Bacik <josef@xxxxxxxxxxxxxx>
> Subject: [PATCH net-next v2 10/10] net: skbuff: don't reset truesize in
> skb_condense() if the pull fails
> 
> skb_condense() pulls all of the frag data into the head and then sets
> truesize to cover just the head, but it ignores the return value of
> __pskb_pull_tail().  If the pull failed, the frags would still be
> attached and truesize would undercount them.
> 
> It can't fail today.  The caller has checked that the head has room,
> that the skb isn't cloned and that the frags are readable, and pulling
> all of data_len eats every frag_list skb whole, so nothing is allocated.
> Check the result anyway and leave the skb alone on failure, so this
> stays correct if any of that changes.  Use __skb_linearize(), which is
> what this pull is.
> 
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> ---
>  net/core/skbuff.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c index
> f798118df112..556d37981f0f 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -7158,7 +7158,8 @@ void skb_condense(struct sk_buff *skb)
>                       return;
> 
>               /* Nice, we can free page frag(s) right now */
> -             __pskb_pull_tail(skb, skb->data_len);
> +             if (__skb_linearize(skb))
> +                     return;
>       }
>       /* At this point, skb->truesize might be over estimated,
>        * because skb had a fragment, and fragments do not tell
> 
> --
> 2.55.0

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>