Re: [PATCH net v2] inet: frags: prevent acceptance of partially authenticated reassembly

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Dave Miller <davem@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>:

On Fri, 23 Oct 2026 18:51:19 +0000 you wrote:
> A reassembled skb retains the secpath from its first fragment, which
> makes it possible for the final policy check to accept bytes that were
> not covered by the transform recorded on the skb. This can affect IPsec
> tunnel traffic, including AH and ESP, and allow a packet to be accepted
> even though only part of its payload was authenticated.
> 
> Reject a fragment when its secpath differs from the fragments already
> in the queue, and keep overlap statistics limited to actual overlaps.
> 
> [...]

Here is the summary with links:
  - [net,v2] inet: frags: prevent acceptance of partially authenticated reassembly
    https://git.kernel.org/netdev/net/c/6fb4e32f2ce3

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html