Re: [PATCH net v3] xfrm: esp: reset outer TCP GSO metadata on espintcp input

[Guoshuai Yang]

On Tue, Oct 27, 2026 at 07:31:06AM +0000, netdev-bot+sashiko@xxxxxxxxxx wrote:
> [Severity: Low]
> Is enabling rx-gro-list enough on its own to reach this case?
...
> Could the commit message describe that topology? Could it also say that
> this half of the fix depends on TCP fraglist GRO? That feature is much
> newer than e27cca96cd68 from the Fixes: tag, so on stable trees without it
> the pre-pass does nothing.
>
> [Severity: Medium]
> Is there still a BUG_ON() at this point? In the tree this patch targets,
> skb_segment() handles the condition like this:
...
> Could the commit message say which kernel the trace came from? Could it
> also describe the behavior on the kernels this patch targets?
>
> [Severity: Medium]
> Can fragp point at the ->next field of a member that is still shared when
> this store happens?
...
> This relink pattern looks like it comes from ___pskb_trim(). That function
> handles skb_shared() on every member before skipping any, so it never
> writes through a shared predecessor. Would it be safer to privatize every
> member walked so far, including the skipped ones, or to copy from the first
> shared member onward the way skb_cow_data() does?

Thank you for the detailed review. All three points are valid:

1. In esp_reset_espintcp_fraglist_gso(), skipping a shared predecessor
   before checking skb_shared(frag) means a subsequent *fragp = frag store
   would overwrite the shared predecessor's ->next pointer across both
   clones. Unsharing every walked frag_list member first (as ___pskb_trim()
   does) before checking SKB_GSO_FRAGLIST guarantees that fragp always
   points into an unshared predecessor.
2. In the commit message, I will clarify that the BUG_ON(!list_skb->head_frag)
   oops trace was captured on a 6.12 LTS kernel, whereas on current mainline
   kernels skb_segment() hits DEBUG_NET_WARN_ON_ONCE(1) and returns -EINVAL,
   causing validate_xmit_skb() to drop the packet.
3. I will also clarify the topology required for TCP fraglist GRO
   (SKB_GSO_FRAGLIST) to reach esp_input() (e.g., rx-gro-list on a device in
   an outer netns forwarded across veth into the netns hosting the espintcp
   socket) and note that this pre-pass applies to kernels with TCP fraglist
   GRO support.

I will send a v4 with these updates.

pw-bot: cr