[PATCH] net: core: use WARN_ON_ONCE in datagram iterators

[PATCH] net: core: use WARN_ON_ONCE in datagram iterators

[Igor Putko]

Datagram fragment iteration helpers check for invalid buffer offsets
using WARN_ON(). In fast-path packet processing routines, a malformed
skb or lower-level driver bug triggering this check can result in
unbounded dmesg logging.

Excessive console logging in data-path contexts introduces severe I/O
latency overhead and risks triggering a DoS or system instability
via log flooding.

Replace WARN_ON() with WARN_ON_ONCE() in __skb_datagram_iter() and
skb_copy_datagram_from_iter(). This ensures anomalous conditions remain
reportable for debugging without spamming the kernel log on repeated
occurrences.

Signed-off-by: Igor Putko <igorpetindev@gmail.com>
---
 net/core/datagram.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/core/datagram.c b/net/core/datagram.c
index c285c6465..125b52870 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -416,7 +416,7 @@ static int __skb_datagram_iter(const struct sk_buff *skb, int offset,
 		int end;
 		const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
-		WARN_ON(start > offset + len);
+		WARN_ON_ONCE(start > offset + len);
 
 		end = start + skb_frag_size(frag);
 		if ((copy = end - offset) > 0) {
@@ -449,7 +449,7 @@ static int __skb_datagram_iter(const struct sk_buff *skb, int offset,
 	skb_walk_frags(skb, frag_iter) {
 		int end;
 
-		WARN_ON(start > offset + len);
+		WARN_ON_ONCE(start > offset + len);
 
 		end = start + frag_iter->len;
 		if ((copy = end - offset) > 0) {
@@ -570,7 +570,7 @@ int skb_copy_datagram_from_iter(struct sk_buff *skb, int offset,
 		int end;
 		const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
 
-		WARN_ON(start > offset + len);
+		WARN_ON_ONCE(start > offset + len);
 
 		end = start + skb_frag_size(frag);
 		if ((copy = end - offset) > 0) {
@@ -594,7 +594,7 @@ int skb_copy_datagram_from_iter(struct sk_buff *skb, int offset,
 	skb_walk_frags(skb, frag_iter) {
 		int end;
 
-		WARN_ON(start > offset + len);
+		WARN_ON_ONCE(start > offset + len);
 
 		end = start + frag_iter->len;
 		if ((copy = end - offset) > 0) {
-- 
2.47.3

Re: [PATCH] net: core: use WARN_ON_ONCE in datagram iterators

[Pavan Chebbi]

[-- Attachment #1: Type: text/plain, Size: 2761 bytes --]

On Tue, Jul 14, 2026 at 1:55 PM Igor Putko <igorpetindev@gmail.com> wrote:
>
> Datagram fragment iteration helpers check for invalid buffer offsets
> using WARN_ON(). In fast-path packet processing routines, a malformed
> skb or lower-level driver bug triggering this check can result in
> unbounded dmesg logging.
>

IMO the things that you mention as the root cause are the ones need
fixing.  I don't see a reason why the log should be changed here..

> Excessive console logging in data-path contexts introduces severe I/O
> latency overhead and risks triggering a DoS or system instability
> via log flooding.
>
> Replace WARN_ON() with WARN_ON_ONCE() in __skb_datagram_iter() and
> skb_copy_datagram_from_iter(). This ensures anomalous conditions remain
> reportable for debugging without spamming the kernel log on repeated
> occurrences.
>
> Signed-off-by: Igor Putko <igorpetindev@gmail.com>
> ---
>  net/core/datagram.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/net/core/datagram.c b/net/core/datagram.c
> index c285c6465..125b52870 100644
> --- a/net/core/datagram.c
> +++ b/net/core/datagram.c
> @@ -416,7 +416,7 @@ static int __skb_datagram_iter(const struct sk_buff *skb, int offset,
>                 int end;
>                 const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
>
> -               WARN_ON(start > offset + len);
> +               WARN_ON_ONCE(start > offset + len);
>
>                 end = start + skb_frag_size(frag);
>                 if ((copy = end - offset) > 0) {
> @@ -449,7 +449,7 @@ static int __skb_datagram_iter(const struct sk_buff *skb, int offset,
>         skb_walk_frags(skb, frag_iter) {
>                 int end;
>
> -               WARN_ON(start > offset + len);
> +               WARN_ON_ONCE(start > offset + len);
>
>                 end = start + frag_iter->len;
>                 if ((copy = end - offset) > 0) {
> @@ -570,7 +570,7 @@ int skb_copy_datagram_from_iter(struct sk_buff *skb, int offset,
>                 int end;
>                 const skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
>
> -               WARN_ON(start > offset + len);
> +               WARN_ON_ONCE(start > offset + len);
>
>                 end = start + skb_frag_size(frag);
>                 if ((copy = end - offset) > 0) {
> @@ -594,7 +594,7 @@ int skb_copy_datagram_from_iter(struct sk_buff *skb, int offset,
>         skb_walk_frags(skb, frag_iter) {
>                 int end;
>
> -               WARN_ON(start > offset + len);
> +               WARN_ON_ONCE(start > offset + len);
>
>                 end = start + frag_iter->len;
>                 if ((copy = end - offset) > 0) {
> --
> 2.47.3
>
>

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5469 bytes --]