Re: [PATCH] ipv4: keep XFRM headers out of corked skb lengths

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Thu, 29 Oct 2026 21:22:29 -0700 you wrote:
> __ip_append_data() allocates space for dst.header_len in the first skb,
> but includes that space in skb->len until __ip_make_skb() pulls it.
> Fragment accounting uses an MTU that already excludes the XFRM headers.
> As a result, the next skb can have a fraggap larger than its capped
> datalen, and skb_copy_and_csum_bits() can overwrite its shared info.
> 
> For example, five AH tunnel states can reserve 500 bytes while leaving
> an effective MTU of 348. With 40 bytes of IPv4 options, the second skb
> has room for 288 bytes of fragment data but receives a 500-byte gap
> copy. The overwritten shared info is subsequently consumed by the skb
> release paths.
> 
> [...]

Here is the summary with links:
  - ipv4: keep XFRM headers out of corked skb lengths
    https://git.kernel.org/netdev/net/c/0f47fce51a98

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html