Re: [PATCH net v2] net: gro: avoid parsing headers from shared fragments

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Fri, 30 Oct 2026 22:07:52 -0700 you wrote:
> When an skb has an empty linear head, skb_gro_reset_offset() can expose
> the first page fragment directly to GRO header parsers. For an
> SKBFL_SHARED_FRAG skb, those bytes may still be writable through a file
> mapping. Headers validated during receive can therefore differ from the
> headers later copied into the linear head and used during completion.
> 
> For example, changing an IPv6 destination-options length between the
> short and full header fetches in ipv6_gro_pull_exthdrs() can make
> ipv6_gro_complete() pass an out-of-bounds offset to udp6_gro_complete().
> A userspace reproducer triggered a KASAN slab-out-of-bounds read there
> on an unmodified kernel as UID 1000. The same completion path can write
> the UDP checksum and length through the invalid offset. The packet has
> trusted TCP GSO metadata and spliced file data, so it reaches completion
> without an skb zerocopy destructor or a second GRO packet.
> 
> [...]

Here is the summary with links:
  - [net,v2] net: gro: avoid parsing headers from shared fragments
    https://git.kernel.org/netdev/net/c/44818c9a826d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html