Re: [PATCH net v4 1/4] net: make room for the tunnel header in skb_segment_list()

[Eric Dumazet]

Le mar. 3 nov. 2026 à 13:43, Simon Horman <horms@xxxxxxxxxx> a écrit :
>
> On Sun, Nov 01, 2026 at 05:42:29PM +0100, Julius Bairaktaris wrote:
> > skb_segment_list() pushes each frag_list member back to the outer MAC
> > header and copies the tunnel headers in front of it, but never checks
> > that the member has the headroom. A fraglist GRO packet forwarded into
> > a tunnel and segmented in software then hits skb_under_panic() on IPIP,
> > and on VXLAN the copy writes before the member's head (KASAN:
> > slab-out-of-bounds write in skb_segment_list()).
> >
> > Call skb_cow_head() on each member before pushing it.
> >
> > Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
> > Signed-off-by: Julius Bairaktaris <julius@xxxxxxxxxxxxxx>
>
> Reviewed-by: Simon Horman <horms@xxxxxxxxxx>

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>

Thanks!