Re: [PATCH net v4 1/4] net: make room for the tunnel header in skb_segment_list()

[Simon Horman]

On Sun, Nov 01, 2026 at 05:42:29PM +0100, Julius Bairaktaris wrote:
> skb_segment_list() pushes each frag_list member back to the outer MAC
> header and copies the tunnel headers in front of it, but never checks
> that the member has the headroom. A fraglist GRO packet forwarded into
> a tunnel and segmented in software then hits skb_under_panic() on IPIP,
> and on VXLAN the copy writes before the member's head (KASAN:
> slab-out-of-bounds write in skb_segment_list()).
> 
> Call skb_cow_head() on each member before pushing it.
> 
> Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
> Signed-off-by: Julius Bairaktaris <julius@xxxxxxxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>