On Thu, Jul 25, 2024 at 5:22 AM Denis Arefev <[email protected]> wrote: > > I checked the patch on three reproducers and all three DEFINITELY broke the > core. > > There are two malfunctions. > > 1. No flag skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; > If it is not set then __skb_linearize will not be executed in > skb_checksum_help. > sk_buff remains fragmented (non-linear) and this is the first warning. > OR add skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG. > OR ask Eric Dumazet (cef401de7be8c). Is checking if > (skb_has_shared_frag(skb)) so important? > in the skb_checksum_help function, is it enough if (skb_is_nonlinear(skb)) ?
Thanks for sharing the reproducers. Having a look. On SKBFL_SHARED_FRAG: as Eric's commit indicates, that flag identifies packets with contents writable from userspace, such as vmsplice or later introduced MSG_ZEROCOPY. That is not the case for these packets. Setting the flag may have the desired effect of triggering linearization, but it does not match the intent of the flag. I think we can catch these bad packets with illegal csum_start and simply drop them. The question is where is the best place to detect them. I gave one suggestion. Great to have reproducers. Let's see if that indeed addresses them.
