Re: [PATCH net 0/2] ipv4: harden against ihl < 5 IP_HDRINCL packets

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Tue, 12 May 2026 16:51:13 -0400 you wrote:
> This series fixes a size_t underflow in net/ipv4/ah4.c:ah_output()
> reachable when a raw IP_HDRINCL socket sends a packet with ihl < 5
> through an xfrm AH policy.  Originally triaged on security@kernel.org;
> moving to netdev at Herbert's suggestion so nftables / netfilter
> maintainers can weigh in on a related question (see "Open question"
> below).  Herbert also asked for the malformed packet to be rejected
> upstream of AH rather than guarded at the AH consumer; that is
> patch 1/2.  v1's AH-side guard is kept here as 2/2 defense-in-depth.
> 
> [...]

Here is the summary with links:
  - [net,1/2] ipv4: raw: reject IP_HDRINCL packets with ihl < 5
    https://git.kernel.org/netdev/net/c/915fab69823a
  - [net,2/2] ipv4: ah: harden ah_output options-copy guard against ihl < 5
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html