> -----Original Message----- > From: Josef Bacik <[email protected]> > Sent: Thursday, October 8, 2026 11:03 PM > To: Jakub Kicinski <[email protected]>; Paolo Abeni <[email protected]>; > Eric Dumazet <[email protected]>; David S. Miller > <[email protected]>; Andrew Lunn <[email protected]> > Cc: Saeed Mahameed <[email protected]>; Tariq Toukan > <[email protected]>; Mark Bloch <[email protected]>; Leon Romanovsky > <[email protected]>; Juergen Gross <[email protected]>; Stefano Stabellini > <[email protected]>; Oleksandr Tyshchenko > <[email protected]>; Nguyen, Anthony L > <[email protected]>; Kitszel, Przemyslaw > <[email protected]>; Manish Chopra <[email protected]>; > Rahul Verma <[email protected]>; [email protected]; Shahed > Shaikh <[email protected]>; Simon Horman <[email protected]>; > [email protected]; [email protected]; linux- > [email protected]; [email protected]; intel-wired- > [email protected]; Josef Bacik <[email protected]> > Subject: [PATCH net-next v2 10/10] net: skbuff: don't reset truesize in > skb_condense() if the pull fails > > skb_condense() pulls all of the frag data into the head and then sets > truesize to cover just the head, but it ignores the return value of > __pskb_pull_tail(). If the pull failed, the frags would still be > attached and truesize would undercount them. > > It can't fail today. The caller has checked that the head has room, > that the skb isn't cloned and that the frags are readable, and pulling > all of data_len eats every frag_list skb whole, so nothing is allocated. > Check the result anyway and leave the skb alone on failure, so this > stays correct if any of that changes. Use __skb_linearize(), which is > what this pull is. > > Assisted-by: LLM > Signed-off-by: Josef Bacik <[email protected]> > --- > net/core/skbuff.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/net/core/skbuff.c b/net/core/skbuff.c index > f798118df112..556d37981f0f 100644 > --- a/net/core/skbuff.c > +++ b/net/core/skbuff.c > @@ -7158,7 +7158,8 @@ void skb_condense(struct sk_buff *skb) > return; > > /* Nice, we can free page frag(s) right now */ > - __pskb_pull_tail(skb, skb->data_len); > + if (__skb_linearize(skb)) > + return; > } > /* At this point, skb->truesize might be over estimated, > * because skb had a fragment, and fragments do not tell > > -- > 2.55.0
Reviewed-by: Aleksandr Loktionov <[email protected]>
