Re: [PATCH net v2] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Florian Westphal <fw@xxxxxxxxx>:

On Wed,  8 Jul 2026 18:11:50 +0000 you wrote:
> br_ip6_fragment() gets prevhdr, a pointer into the skb head, from
> ip6_find_1stfragopt(), then calls skb_checksum_help().  For a cloned skb
> skb_checksum_help() reallocates the head via pskb_expand_head(), leaving
> prevhdr dangling.  It is later dereferenced in ip6_frag_next(), causing a
> use-after-free write.
> 
> Save prevhdr's offset before skb_checksum_help() and recompute it after,
> like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6
> fragment").
> 
> [...]

Here is the summary with links:
  - [net,v2] netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
    https://git.kernel.org/netdev/net/c/86f3ce81dd2b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html