Re: [PATCH net-next v9 2/9] net: Enable BIG TCP with partial GSO

On 7/16/26 6:28 PM, Alice Mikityanska wrote:

On Thu, 16 Jul 2026 at 17:47, Simon Horman [off-list ref] wrote:

quoted

[Severity: Medium]
Can the partial_segs calculation exceed 65535 for malicious inputs and cause
a 16-bit truncation?

If a crafted packet with a very small gso_size (for example, mss=1 via an
untrusted packet socket) and a large payload is segmented, len / mss could
produce a value greater than 65535.

When this 32-bit value is later assigned to the 16-bit field in skb_segment():

net/core/skbuff.c:skb_segment() {
    ...
    skb_shinfo(iter)->gso_segs = partial_segs;
    ...
}

I'll clamp partial_segs to GSO_MAX_SEGS=65535 to make sure that
gso_segs doesn't overflow. Worst case, in an extreme scenario of
gso_size=1, partial GSO will produce more than 2 output SKBs, but the
traffic should still flow — this is how BIG TCP SKBs were handled by
skb_segment before this change.

I *think* this is better handled when the bad GSO segment is
(potentially) assembled - at GRO aggregation and virtio_net_hdr
conversion. Possibly a check in skb_gro_receive() should cover both cases.

Also if this is the only pending item I think it's better handled as a
follow-up.

Thanks,

Paolo