Re: [PATCH net-next 04/15] net: skbuff: fail segmentation when a segment can't be checksummed

[Mina Almasry <almasrymina@xxxxxxxxxx>]

On Mon, Oct 19, 2026 at 6:51 AM Josef Bacik <josef@xxxxxxxxxxxxxx> wrote:
>
> When the device can't checksum the protocol, skb_segment() computes
> each segment's checksum in software with skb_checksum().  With SG on,
> the segments share the original frags, and a devmem TCP skb keeps its
> whole payload in unreadable frags.  The devmem MSG_ZEROCOPY path never
> sets SKBFL_SHARED_FRAG, so the __skb_linearize() fallback is skipped
> too.  skb_checksum() then warns and returns 0, and tcp_gso_segment()
> writes a TCP checksum that doesn't cover the payload that goes out.
>
> That's reachable with tx-checksumming off and SG on: sk_setup_caps()
> still gives TCP SG and HW_CSUM, so the dmabuf send is accepted, and
> harmonize_features() strips the checksum features but keeps SG.
>
> Use skb_checksum_full() and fail the segmentation with -EFAULT when it
> can't checksum a segment, as skb_segment() already does when it can't
> copy one.
>
> Found by the Sashiko AI review of an earlier fix for the same path with
> SG off.
>
> Link: 
> https://lore.kernel.org/all/20261009-b4-skb-segment-nosg-unreadable-v1-1-7e2334a55fe8@xxxxxxxxxxxxxx/
> Assisted-by: LLM
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> ---
>  net/core/skbuff.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index 40d2dd20d47d..88ed2dd99dc0 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -5239,9 +5239,13 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
>
>                         if (!nskb->remcsum_offload)
>                                 nskb->ip_summed = CHECKSUM_NONE;
> -                       SKB_GSO_CB(nskb)->csum =
> -                               skb_checksum(nskb, doffset,
> -                                            nskb->len - doffset, 0);
> +                       SKB_GSO_CB(nskb)->csum = 0;

So I wonder if this needs to be a generic thing to do insidk of
skb_checksum_full. It seems like the previous patch is complaining
some fields in the skb are no-longer set correctly if we fail
checksumming, like ip_summ. Maybe ->csum as well should not be left
set to non-zero if skb_checksum_full fails.

Anyway,

Reviewed-by: Mina Almasry <almasrymina@xxxxxxxxxx>


-- 
Thanks,
Mina