Re: [PATCH nf v2] netfilter: handle unreadable frags

On Tue, Jul 7, 2026 at 4:18 AM Florian Westphal <[email protected]> wrote:
>
> sashiko reports:
>  When an skb with unreadable fragments (such as from devmem TCP, where
>  skb_frags_readable(skb) returns false) is processed by the u32 module,
>  skb_copy_bits() will safely return a negative error code [..]
>
> xt_u32: bail out with hotdrop in this case.
> gather_frags: return -1, just as if we had no fragment header.
> nfnetlink_queue: restrict to the non-linear part.
> nfnetlink_log: restrict to the non-linear part.
>
> v2:
>  - skb_zerocopy helpers don't copy readable flag, i.e. nfnetlink_queue
>  is broken too
>  xt_u32 shouldn't return true if hotdrop was set.
>
> Cc: Mina Almasry <[email protected]>
> Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags")
> Signed-off-by: Florian Westphal <[email protected]>

I don't understand netfliter implementations enough to confirm the
error handling is correct, but in general handling skb_copy_bits()
failures due to unreadable frags sounds good to me. I definitely did
not address all the call sites in the first iteration, so:

Acked-by: Mina Almasry <[email protected]>

> ---
>  Mina, there are other places that BUG on skb_copy_bits().
>  Could you please have a look at:
>
>  https://sashiko.dev/#/patchset/20260706155219.23757-1-fw%40strlen.de
>
>  and see if those need fixing or not?
>  [ and the v2 review of this ... ]
>
>  Also, should skb_zerocopy() copy over the skb->readable
>  flag (or refuse to handle unreadable skbs)?
>

Yep it's buggy :(. From my reading, skb_zerocopy() needs to set the
skb->readable frag on the to skb (and clear it on the from skb?). Let
me find the cycles to fix that.

-- 
Thanks,
Mina