Re: [PATCH net v4 1/8] xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices

On Tue, Apr 28, 2026 at 4:13 PM Paolo Abeni <[email protected]> wrote:
>
> On 4/25/26 7:40 AM, [email protected] wrote:
> > Sashiko AI review found 1 potential issue(s):
> > - [High] The patch incompletely fixes the WARN_ON_ONCE in skb_checksum_help() triggered by pure-fragment SKBs. It successfully prevents the explicit fallback in xsk_skb_metadata() (which wedged the TX ring), but leaves the implicit generic network stack fallback vulnerable. If a user sets XDP_TXMD_FLAGS_CHECKSUM on an IFF_TX_SKB_NO_LINEAR device and the hardware checksum offload is disabled at runtime (e.g., via `ethtool -K eth0 tx off`), the core stack's validate_xmit_skb() takes over. Because NETIF_F_SG is allowed to remain active even without checksum features, skb_needs_linearize() evaluates to false, leaving the SKB unlinearized. The SKB is then passed to skb_csum_hwoffload_help() -> skb_checksum_help(), which hits the exact same WARN_ON_ONCE(offset >= skb_headlen(skb)) because skb_headlen is 0.
> > --
> >
> > commit 86ab0a4900aa60bee0c3df7393a2846b5ff74ccb
> > Author: Jason Xing <[email protected]>
> >
> > xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices
> >
> > This commit attempts to fix a warning triggered in skb_checksum_help()
> > by AF_XDP pure-fragment SKBs. It rejects sw-csum UMEM binding for
> > drivers advertising IFF_TX_SKB_NO_LINEAR at setup time.
> >
> > Closes: https://lore.kernel.org/all/[email protected]/#t
> > Fixes: 30c3055f9c0d ("xsk: wrap generic metadata handling onto separate function")
> > Acked-by: Stanislav Fomichev <[email protected]>
> > Signed-off-by: Jason Xing <[email protected]>
> >
> >> diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
> >> index cd7bc50872f6b5..d981cfdd853578 100644
> >> --- a/net/xdp/xsk_buff_pool.c
> >> +++ b/net/xdp/xsk_buff_pool.c
> >> @@ -175,6 +175,9 @@ int xp_assign_dev(struct xsk_buff_pool *pool,
> >>      if (force_zc && force_copy)
> >>              return -EINVAL;
> >>
> >> +    if (pool->tx_sw_csum && (netdev->priv_flags & IFF_TX_SKB_NO_LINEAR))
> >> +            return -EOPNOTSUPP;
> >> +
> >
> > Does this still leave a path for the warning in skb_checksum_help() to
> > trigger if hardware checksum offloading is disabled at runtime?
> >
> > If a user sets XDP_TXMD_FLAGS_CHECKSUM on an IFF_TX_SKB_NO_LINEAR device,
> > and hardware checksum offload is later disabled (e.g., via ethtool -K
> > eth0 tx off), the core stack's validate_xmit_skb() will take over.
> >
> > Because NETIF_F_SG can remain active even without checksum features,
> > skb_needs_linearize() evaluates to false, leaving the SKB unlinearized.
> >
> > The SKB is then passed to skb_csum_hwoffload_help() which falls back to
> > skb_checksum_help(). Since the pure-fragment SKB still has a headlen of 0,
> > won't this hit the exact same WARN_ON_ONCE(offset >= skb_headlen(skb))
> > warning?
>
> My take here is the issue describe above should be handled separately.
> (And on top of my head I don't see an easy way to address it short of an
> additional check in the tx path, which I think we want to avoid).

Agreed. I've already reworded the commit message locally :)

Thanks,
Jason