Re: [PATCH] net: skbuff: don't BUG() when skb_copy_bits() fails in __pskb_pull_tail

[shao.mingyin]

On Sat, Nov 07, 2026 at 10:04:25AM -0500, Willem de Bruijn wrote:
> In the series, Josef reported
>
>   Two BUG_ON()s are left on purpose.  __pskb_pull_tail() and
>   skb_pull_rcsum() have callers that can't otherwise fail, so they don't
>   check the return.  Some of them would carry on and BUG() somewhere
>   else, or push back a pull that never happened.  Those need their
>   callers fixed first and will come as separate series.

Yes, and this is that separate series for __pskb_pull_tail();
skb_pull_rcsum() is still untouched.

The return contract is not new.  __pskb_pull_tail() already returns NULL
today when skb_frags_readable() is false or pskb_expand_head() fails; the
patch only stops BUG()ing on the third failure, skb_copy_bits() failing on
a frag_list child.  That failure returns before the commit block at the
bottom, so the skb is left exactly as it was (apart from a possible head
realloc) and there is no half-done pull to push back.

Of the direct callers that ignore the return:

- skb_condense() is the one that can reach it.  It runs on receive skbs
  that can carry a frag_list, i.e. the GRO-merged skb from
  skb_gro_receive() that the patch is about; it now checks the return and
  keeps truesize.

- xen-netfront pulls pull_to - skb_headlen() only when nr_frags is already
  MAX_SKB_FRAGS.  On failure nothing is committed, so nr_frags is still
  MAX_SKB_FRAGS and the check right below drops the skb with -ENOENT.
  That is the same path the existing NULL returns already take.

- niu, mlx5 and ftmac100 cannot reach it: delta is bounded by
  skb->data_len at the call site (niu caps the pull at sizeof(*rh) +
  VLAN_ETH_HLEN, mlx5 clamps to skb->data_len, ftmac100 pulls ETH_HLEN or
  the frame length), and their skbs are built from page frags only, never
  with a frag_list child, so skb_copy_bits() cannot fail.

skb_pull() propagates the same NULL as before; on the GRO path the
protocol handlers get at the data through pskb_may_pull().  A length
mismatch is a driver bug, and DEBUG_NET_WARN_ON_ONCE() reports it.

Thanks,
Shao