Re: [PATCH net v4 1/8] xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices

On Tue, Apr 28, 2026 at 4:13 PM Paolo Abeni [off-list ref] wrote:

On 4/25/26 7:40 AM, sashiko-bot@kernel.org wrote:

quoted

Sashiko AI review found 1 potential issue(s):
- [High] The patch incompletely fixes the WARN_ON_ONCE in skb_checksum_help() triggered by pure-fragment SKBs. It successfully prevents the explicit fallback in xsk_skb_metadata() (which wedged the TX ring), but leaves the implicit generic network stack fallback vulnerable. If a user sets XDP_TXMD_FLAGS_CHECKSUM on an IFF_TX_SKB_NO_LINEAR device and the hardware checksum offload is disabled at runtime (e.g., via `ethtool -K eth0 tx off`), the core stack's validate_xmit_skb() takes over. Because NETIF_F_SG is allowed to remain active even without checksum features, skb_needs_linearize() evaluates to false, leaving the SKB unlinearized. The SKB is then passed to skb_csum_hwoffload_help() -> skb_checksum_help(), which hits the exact same WARN_ON_ONCE(offset >= skb_headlen(skb)) because skb_headlen is 0.
--

commit 86ab0a4900aa60bee0c3df7393a2846b5ff74ccb
Author: Jason Xing [off-list ref]

xsk: reject sw-csum UMEM binding to IFF_TX_SKB_NO_LINEAR devices

This commit attempts to fix a warning triggered in skb_checksum_help()
by AF_XDP pure-fragment SKBs. It rejects sw-csum UMEM binding for
drivers advertising IFF_TX_SKB_NO_LINEAR at setup time.

Closes: https://lore.kernel.org/all/20260419045822.843BFC2BCAF@smtp.kernel.org/#t (local)
Fixes: 30c3055f9c0d ("xsk: wrap generic metadata handling onto separate function")
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Jason Xing <kernelxing@tencent.com>

quoted

diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
index cd7bc50872f6b5..d981cfdd853578 100644
--- a/net/xdp/xsk_buff_pool.c
+++ b/net/xdp/xsk_buff_pool.c

@@ -175,6 +175,9 @@ int xp_assign_dev(struct xsk_buff_pool *pool,
     if (force_zc && force_copy)
             return -EINVAL;

+    if (pool->tx_sw_csum && (netdev->priv_flags & IFF_TX_SKB_NO_LINEAR))
+            return -EOPNOTSUPP;
+

Does this still leave a path for the warning in skb_checksum_help() to
trigger if hardware checksum offloading is disabled at runtime?

If a user sets XDP_TXMD_FLAGS_CHECKSUM on an IFF_TX_SKB_NO_LINEAR device,
and hardware checksum offload is later disabled (e.g., via ethtool -K
eth0 tx off), the core stack's validate_xmit_skb() will take over.

Because NETIF_F_SG can remain active even without checksum features,
skb_needs_linearize() evaluates to false, leaving the SKB unlinearized.

The SKB is then passed to skb_csum_hwoffload_help() which falls back to
skb_checksum_help(). Since the pure-fragment SKB still has a headlen of 0,
won't this hit the exact same WARN_ON_ONCE(offset >= skb_headlen(skb))
warning?

My take here is the issue describe above should be handled separately.
(And on top of my head I don't see an easy way to address it short of an
additional check in the tx path, which I think we want to avoid).

Agreed. I've already reworded the commit message locally :)

Thanks,
Jason