Re: [PATCH net v5 2/4] net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

[netdev-bot+sashiko@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider:

Critical: 0 · High: 0 · Medium: 0 · Low: 1

- [Low] Claim that the commit message's "Steps to reproduce (included in
  the new selftest)" references a selftest that does not exist in this…

--

net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

The change clamps cork->base.fragsize to IP6_MAX_MTU in ip6_setup_cork() for
UDP sockets, so a device MTU larger than IP6_MAX_MTU combined with
IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE can no longer produce a 16-bit UDP
length overflow. Raw IPv6 sockets are left alone so jumbograms keep working.

Link: https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/

> diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
> index 8fc4766c8da90..5509650589915 100644
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -1432,6 +1432,8 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
>  	if (frag_size && frag_size < mtu)
>  		mtu = frag_size;
>  
> +	if (sk_is_udp(sk))
> +		mtu = min(mtu, IP6_MAX_MTU);
>  	cork->base.fragsize = mtu;
>  	cork->base.gso_size = ipc6->gso_size;
>  	cork->base.tx_flags = 0;

One note on the changelog rather than the code:

> Steps to reproduce (included in the new selftest):

[Severity: Low]
This turned out to be accurate, so no change is needed here; noting it only
because the reference is forward-looking within the series.

This commit only touches net/ipv6/ip6_output.c, so "the new selftest" is not
present in this commit itself.  The test is added by the later patch in the
same series, "selftests: net: Test UDP length overflow with PMTU discover and
big MTU", which creates tools/testing/selftests/net/cork_fragsize.py and adds
it to TEST_PROGS in tools/testing/selftests/net/Makefile:

  +	cork_fragsize.py \

The ipv6 variant of test_udp() there does set up a dummy netdev with an MTU
above IP6_MAX_MTU, sets IPV6_MTU_DISCOVER to IPV6_PMTUDISC_DO, sends 65528
bytes and expects EMSGSIZE, and test_ipv6_jumbo() covers the raw socket
jumbogram case mentioned in the last paragraph of the changelog.

Would it be worth saying "included in a selftest added later in this series"
so that anyone reading or backporting this commit alone knows where to look?

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260901195714.673548-1-alice.kernel%40fastmail.im