Re: [PATCH net] net: skbuff: don't segment unreadable skbs without SG

[Josef Bacik]

On Sat, Oct 10, 2026 at 01:33:14PM +0000, netdev-bot+sashiko@xxxxxxxxxx wrote:
> Does this guard also need to cover the sg && !csum case?
>
> The commit message says:
>
>   "and with only checksum offload off the segments keep sharing
>   the frags."

The segments do keep sharing the frags in that case, so this bug, the
payload being replaced with zeroes, doesn't happen there.  The commit
message shouldn't have implied the case is fine though.

> The devmem MSG_ZEROCOPY path in tcp_sendmsg_locked() goes through
> skb_zerocopy_iter_stream() and never sets SKBFL_SHARED_FRAG. As far as I
> can tell, only the MSG_SPLICE_PAGES branch sets it. That means the
> __skb_linearize() fallback is skipped and skb_checksum() is called on an
> nskb whose payload is entirely in unreadable frags.

With SG on and checksum offload off, skb_segment() calls
skb_checksum() on each segment, and skb_checksum() can't report
failure, so on unreadable frags it WARNs and returns 0 and the segment
goes out with a checksum that doesn't cover the payload.  That's been
there since 65249feb6b3d ("net: add support for skbs with unreadable
frags").

> Would checking !sg || !csum here be more appropriate?

v2 drops this check.  Mina asked for skb_copy_and_csum_bits() to
report the error itself instead, so v2 changes it to return -EFAULT on
unreadable frags and every caller handles that, skb_segment() included.
The commit message there only describes the case with both SG and
checksum offload off.  The sg && !csum case needs skb_checksum() to
report failure the same way, and I'll do that as a separate fix.

pw-bot: cr

Thanks,
Josef