RE: [PATCH net-next v2 10/10] net: skbuff: don't reset truesize in skb_condense() if the pull fails

-----Original Message-----
From: Josef Bacik <josef@toxicpanda.com>
Sent: Thursday, October 8, 2026 11:03 PM
To: Jakub Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>;
Eric Dumazet [off-list ref]; David S. Miller
[off-list ref]; Andrew Lunn [off-list ref]
Cc: Saeed Mahameed <saeedm@nvidia.com>; Tariq Toukan
[off-list ref]; Mark Bloch [off-list ref]; Leon Romanovsky
[off-list ref]; Juergen Gross [off-list ref]; Stefano Stabellini
[off-list ref]; Oleksandr Tyshchenko
[off-list ref]; Nguyen, Anthony L
[off-list ref]; Kitszel, Przemyslaw
[off-list ref]; Manish Chopra [off-list ref];
Rahul Verma [off-list ref]; GR-Linux-NIC-Dev@marvell.com; Shahed
Shaikh [off-list ref]; Simon Horman [off-list ref];
netdev@vger.kernel.org; linux-kernel@vger.kernel.org; linux-
rdma@vger.kernel.org; xen-devel@lists.xenproject.org; intel-wired-
lan@lists.osuosl.org; Josef Bacik [off-list ref]
Subject: [PATCH net-next v2 10/10] net: skbuff: don't reset truesize in
skb_condense() if the pull fails

skb_condense() pulls all of the frag data into the head and then sets
truesize to cover just the head, but it ignores the return value of
__pskb_pull_tail().  If the pull failed, the frags would still be
attached and truesize would undercount them.

It can't fail today.  The caller has checked that the head has room,
that the skb isn't cloned and that the frags are readable, and pulling
all of data_len eats every frag_list skb whole, so nothing is allocated.
Check the result anyway and leave the skb alone on failure, so this
stays correct if any of that changes.  Use __skb_linearize(), which is
what this pull is.

Assisted-by: LLM
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
---
 net/core/skbuff.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c index

f798118df112..556d37981f0f 100644

--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c

@@ -7158,7 +7158,8 @@ void skb_condense(struct sk_buff *skb)
 			return;

 		/* Nice, we can free page frag(s) right now */
-		__pskb_pull_tail(skb, skb->data_len);
+		if (__skb_linearize(skb))
+			return;
 	}
 	/* At this point, skb->truesize might be over estimated,
 	 * because skb had a fragment, and fragments do not tell

--

2.55.0