Re: [PATCH net v2] xfrm: esp: reset outer TCP GSO metadata on espintcp input

[Guoshuai Yang]

On Thu, Oct 22, 2026 at 03:05:55PM +0000, netdev-bot+sashiko@xxxxxxxxxx wrote:
> [Severity: Medium]
> Is this reset reached when the outer TCP GRO aggregate carries
> SKB_GSO_FRAGLIST? It only runs after skb_cow_data() succeeds, and
> skb_cow_data() can fail on that gso_type before we get here.
...
> The skb_copy() WARN_ON_ONCE() itself is older than this patch. This is
> still the same stale outer TCP GRO metadata problem the patch sets out to
> fix, and a reset placed after skb_cow_data() can't cover it. Should the
> outer GSO state be handled before or inside the COW step instead?

Good catch. When an ESP record spans an outer TCP GRO aggregate carrying
SKB_GSO_FRAGLIST, __strp_recv() places that aggregate onto
skb_shinfo(head)->frag_list with SKB_GSO_FRAGLIST still set in its
gso_type. In esp_input() and esp6_input(), skb_cow_data() then invokes
skb_copy() / skb_copy_expand() on that frag_list member and hits
WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST), failing with
-ENOMEM before skip_cow is reached.

I will send a v3 that unshares/unclones and resets GSO metadata on any
frag_list member carrying SKB_GSO_FRAGLIST prior to skb_cow_data(), in
addition to resetting GSO metadata on the head skb and frag_list members
at skip_cow.

pw-bot: cr