Re: [PATCH net v3 0/3] net: don't strip zerocopy frag markers from a forwarded skb

Willem de Bruijn <[email protected]>
Newsgroups org.kernel.vger.netdev,org.kernel.vger.linux-kernel
Message-ID <[email protected]>
Ilya Maximets wrote:
> On 8/22/26 2:09 AM, Jakub Kicinski wrote:
> > On Fri, 21 Aug 2026 23:45:41 +0200 Ilya Maximets wrote:
> >> Unfortunately, this needs a rebase now that a conflicting change
> >> for skb_zerocopy() was merged:
> > 
> > Ugh, I was supposed to merge this first, wasn't I? Sorry.
> 
> Not a huge deal, I guess, the conflict is mechanical and the patches
> are simple.  I can take care of manual backports once we get the
> 'failed to apply' emails.  Just a bit of busy work.
> 
> > I was hoping for Willem to TAL since skb_tx_error() is a tx ZC
> > thing, now I realized that he wasn't CCed :S (please do so on v4)
> 
> FWIW, I CCed a few people on v1 to have a conversation about a proper
> fix, but that wasn't fruitful.  So, if I were Norbert, I wouldn't
> include them for the new versions either as doing so always feels like
> me being annoying. :)

Having a look now.
 
> For now, the plan is to get v4 of these targeted fixes into net and
> stable and then remove skb_tx_error() entirely once net-next is open,
> as it seems to have lost all of its prior meaning.

The original use case in tun_net_xmit introduced in commit
149d36f7187c ("tun: report orphan frags errors to zero copy callback")
still exists. Not sure you can remove the function entirely.

The bug is hit when this function is called with a cloned or shared
skb. The original zerocopy path through tun_net_xmit was probably
expected to not have this problem.

Commit 0110d6f22f39 ("tun: orphan an skb on tx") explains why this
orphan in tun_net_xmit was needed: a (vhost) zerocopy skb injected in
tap1 arriving at tap2 and not being read there indefinitely. Such
loops are not allowed for zerocopy.

Commit 868eefeb17d4 ("tun: orphan frags on xmit") then added the
frags orphan. Since an skb can be cloned on this tap to tap path,
e.g., with a packet socket, I think the bug goes back to the original
commit that introduced the first caller of skb_tx_error, commit
149d36f7187c ("tun: report orphan frags errors to zero copy callback")

If respinning it may be worthile to link to this thread.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.