On 7/8/26 12:16 AM, Kyle Zeng wrote:

OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb
length in OVS_CB(skb)->cutlen. When a later userspace action segments a
GSO skb, queue_gso_packets() reuses that delta for each smaller segment.
A segment can then reach queue_userspace_packet() with cutlen greater
than skb->len, underflowing the length passed to skb_zerocopy().

Store the maximum preserved length instead and bound each consumer
against the current skb length. Use U32_MAX as the no-truncation
sentinel so the value remains valid if skb geometry changes before a
consumer handles it.

Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.5
Signed-off-by: Kyle Zeng <redacted>
---

Thanks, Kyle!  For the future, please, don't skip the general networking
maintainers and the ovs dev list while sending openvswitch -related patches.

Otherwise, this patch looks good to me:

Reviewed-by: Ilya Maximets <i.maximets@ovn.org>