Re: [PATCH net] hinic3: bound the Rx fragment count to MAX_SKB_FRAGS

[Fan Gong]

> On 2026-10-19 09:10:37 [+0900], Yehyeong Lee wrote:
> > Thanks for the review.
> >
> > A well-behaved device can't reach it. rx_buf_len is fixed at 2048
> > regardless of MTU, so the frag count is ceil(pkt_len / 2048): a max-MTU
> > frame (9600) is 5 frags, and LRO -- off by default, capped at 32K when
> > enabled -- is at most 16, both below the 17 the array holds. Only the
> > 16-bit length field in the completion descriptor (RQ_CQE_SGE_LEN_MASK)
> > lets a device claim up to 65535 bytes, i.e. 32 frags. So it takes a
> > device reporting a bogus length, i.e. broken or malicious firmware,
> > which is why I treated it as a robustness fix -- I should have said so
> > in the changelog.
>
> If this is something that in general opinion never can be reached then
> it might be something to target net-next and not net looking like a fix.
>
> > I found it by code inspection, not in the field, and I don't have a
> > hinic3 card, so it's untested on real hardware; I reproduced it by
> > injecting an out-of-range length to get the KASAN splat in the
> > changelog. The netdev bot asked for these same two things, so this
> > answers it as well.
>
> I see. That KASAN splat makes it look like something that was really
> reproduced. I assumed jumbo frames and aggregation at HW level.
> Just because a field is 16 bit wide, it does not mean the hardware will
> utilise all its fields.
>
> > You're right that the bare drop is unhelpful. It only surfaces as
> > rx_dropped via ndo_get_stats64, not in ethtool -S -- hinic3 has no
> > get_ethtool_stats, and the stats series in net-next doesn't export
> > dropped either. I'm happy to add a net_warn_ratelimited() on the
> > discard path in v2; it only fires for a misbehaving device, so it won't
> > spam a healthy system. Let me know if you'd like that.
>
> I would suggest to target net-next if this can not be reached and is
> just there to address a possible overflow. Maybe a warning if it was
> reached after all. Fan has probably an opinion here.
>
> > For reference, eea does the same thing -- it drops once nr_frags
> > reaches MAX_SKB_FRAGS.
> >
> > Thanks,
> > Yehyeong

Thank you very much, Yehyeong and Sebastian Andrzej Siewior, for your
investigation into this issue. The current hinic3 driver is a basic
version that does not yet enable Large Receive Offload (LRO); under the
current configuration, no out-of-bounds behavior will occur. For packet
sizes reaching 32 KB or even 60 KB, we have a complete solution that will
be enabled in upcoming submissions. If Yehyeong's issue is urgent, could
you please provide more background information so we can assist you in
resolving it.