Re: [PATCH] net: gro: don't chain linear parts larger than gso_size into frag_list

[Eric Dumazet]

Le mar. 13 oct. 2026 à 12:25, Sorah Fukumori <her@xxxxxxxx> a écrit :
>
> skb_gro_receive() chains an skb into the frag_list of the held packet
> when its payload cannot be attached as page frags, i.e. when its head
> is not a page fragment and still holds payload.

>
> Fully linear GSO packets come from generic XDP. When the program does
> not support frags, netif_skb_check_for_xdp() linearizes any nonlinear
> skb with pskb_expand_head() and skb_linearize() and keeps its GSO
> metadata.

On Tue, Oct 13, 2026 at 12:24 PM Sorah Fukumori <her@xxxxxxxx> wrote:
>
> skb_gro_receive() chains an skb into the frag_list of the held packet
> when its payload cannot be attached as page frags, i.e. when its head
> is not a page fragment and still holds payload.

[...]

> Fully linear GSO packets come from generic XDP. When the program does
> not support frags, netif_skb_check_for_xdp() linearizes any nonlinear
> skb with pskb_expand_head() and skb_linearize() and keeps its GSO
> metadata.

I think the problem is a bit wider than what is described here.

skb_gro_receive() also reaches the merge: label from the head_frag
branch, when the frags do not fit:

if (nr_frags + 1 + skbinfo->nr_frags > MAX_SKB_FRAGS)
goto merge;

A GSO skb with a page frag head holding more than gso_size bytes of
payload is then chained in frag_list as well, and the BUG_ON() in
skb_segment() does not care about head_frag.

It seems an XDP program with frags support in generic mode could
get there: skb_pp_cow_data() builds a head_frag skb with up to
about one page of linear data, the rest in page frags, and
skb_copy_header() keeps the GSO metadata. Two such 64KB packets
can not share a single frags[] array.

Have you tried this variant with your reproducer ?

Your patch handles it anyway, since the check is done at the merge:
label, but the changelog should mention it.

>
> Fixes: 5eddb24901ee ("gro: add support of (hw)gro packets to gro stack")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: claude-opus-5-5
> Signed-off-by: Sorah Fukumori <her@xxxxxxxx>
> ---
>  net/core/gro.c | 4 ++++
>  1 file changed, 4 insertions(+)

Please use [PATCH net] in the subject for fixes.

The fix itself looks good to me, thanks.

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>