Re: [BUG] net/sched: act_csum can checksum beyond a short IPv6 jumbogram skb

[Jamal Hadi Salim]

On Thu, Oct 22, 2026 at 11:36 AM Andrew Lunn <andrew@xxxxxxx> wrote:
>
> On Thu, Oct 22, 2026 at 02:46:53PM +0000, shaos wrote:
> > Hello,
> >
> > An unprivileged process with namespace-scoped CAP_NET_ADMIN and CAP_NET_RAW installs a csum action for UDP-Lite and sends a 300-byte IPv6 frame with a Jumbo Payload value of 0xffffffca and UDP-Lite coverage longer than the bytes present. The jumbo-length addition wraps the pull-length check, while the later checksum path still uses the unwrapped length.
>
> Please configure your editor to wrap lines at around 70
> characters. Standard netiquette rules should be used on mailing lists.
>
> Flooding the netdev list with bug reports like this will just result
> in them being directed to /dev/null.
>
> If you want to do something useful, fix the issue. Please do it
> slowly, one bug report at a time, so you can learn how to do it
> correctly without wasting peoples time.
>

And worse:
1) cross-posting to the security mailing list on bugs that require
CAP_NET_ADMIN and CAP_NET_RAW
2) Parroting quiet a few bugs that are already posted on the list and
undergoing revision adding more work to reviewers.

Which LLM do you use? Teach them to read the mailing list before
declaring an issue unknown. Just because it is not already patched in
the kernel does not mean work isn't already underway. If you fix these
issues, post again.

cheers,
jamal

>    Andrew