6.12.y longterm regression - IPv6 UDP packet fragmentation

6.12.y longterm regression - IPv6 UDP packet fragmentation

[Brett Sheffield]

[-- Attachment #1: Type: text/plain, Size: 939 bytes --]

Hello Stable Maintainers,

Longterm kernel 6.12.y backports commit:

- a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a "ipv6: save dontfrag in cork"

but does not backport these related commits:

- 54580ccdd8a9c6821fd6f72171d435480867e4c3 "ipv6: remove leftover ip6 cookie initializer"
- 096208592b09c2f5fc0c1a174694efa41c04209d "ipv6: replace ipcm6_init calls with ipcm6_init_sk"

This causes a regression when sending IPv6 UDP packets by preventing
fragmentation and instead returning EMSGSIZE. I have attached a program which
demonstrates the issue.

sendmsg() returns correctly (8192) on a working kernel, and returns -1
(EMSGSIZE) when the regression is present.

The regression is not present in the mainline kernel.

Applying the two missing commits to 6.12.y fixes the regression.

Cheers,


Brett
-- 
Brett Sheffield (he/him)
Librecast - Decentralising the Internet with Multicast
https://librecast.net/
https://blog.brettsheffield.com/

[-- Attachment #2: 6.12.y-frag.c --]
[-- Type: text/plain, Size: 1629 bytes --]

/*
 * 6.12.y backports commit:
 * - a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a "ipv6: save dontfrag in cork"
 * but does not backport:
 * - 54580ccdd8a9c6821fd6f72171d435480867e4c3 "ipv6: remove leftover ip6 cookie initializer"
 * - 096208592b09c2f5fc0c1a174694efa41c04209d "ipv6: replace ipcm6_init calls with ipcm6_init_sk"
 *
 * This causes a regression when sending IPv6 UDP packets by preventing
 * fragmentation and instead returning EMSGSIZE. This program demonstrates the
 * issue. sendmsg returns correctly (8192) on a working kernel, and returns -1
 * (EMSGSIZE) when the regression is present.
 *
 * The regression is not present in the mainline kernel.
 *
 * Applying the missing commits to 6.12.y fixes the regression.
 */

#include <netinet/in.h>
#include <sys/socket.h>
#include <stdio.h>

#define LARGER_THAN_MTU 8192

int main(void)
{
	/* address doesn't matter, use an IPv6 multicast address for simplicity */
	struct in6_addr addr = {
		.s6_addr[0] = 0xff, /* multicast */
		.s6_addr[1] = 0x12, /* set flags (T, link-local) */
	};
	struct sockaddr_in6 sa = {
		.sin6_family = AF_INET6,
		.sin6_addr = addr,
		.sin6_port = 4242
	};
	char buf[LARGER_THAN_MTU] = {0};
	struct iovec iov = { .iov_base = buf, .iov_len = sizeof buf};
	struct msghdr msg = {
		.msg_iov = &iov,
		.msg_iovlen = 1,
		.msg_name = (struct sockaddr *)&sa,
		.msg_namelen = sizeof sa,
	};
	ssize_t rc;
	int s = socket(AF_INET6, SOCK_DGRAM, 0);
	msg.msg_name = (struct sockaddr *)&sa;
	msg.msg_namelen = sizeof sa;
	rc = sendmsg(s, &msg, 0);
	if (rc == -1) {
		perror("send");
		return 1;
	}
	printf("send() returned %zi\n", rc);
	return 0;
}

Re: 6.12.y longterm regression - IPv6 UDP packet fragmentation

[Greg KH]

On Wed, Jun 11, 2025 at 01:04:29PM +0200, Brett Sheffield wrote:
> Hello Stable Maintainers,
> 
> Longterm kernel 6.12.y backports commit:
> 
> - a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a "ipv6: save dontfrag in cork"

It's also in older kernels:
	5.10.238
	5.15.185
	6.1.141
	6.6.93

> but does not backport these related commits:
> 
> - 54580ccdd8a9c6821fd6f72171d435480867e4c3 "ipv6: remove leftover ip6 cookie initializer"
> - 096208592b09c2f5fc0c1a174694efa41c04209d "ipv6: replace ipcm6_init calls with ipcm6_init_sk"
> 
> This causes a regression when sending IPv6 UDP packets by preventing
> fragmentation and instead returning EMSGSIZE. I have attached a program which
> demonstrates the issue.

Should we backport thse two to all of the other branches as well?

thanks,

greg k-h

Re: 6.12.y longterm regression - IPv6 UDP packet fragmentation

[Brett Sheffield]

[-- Attachment #1: Type: text/plain, Size: 2118 bytes --]

Hi Greg,

On 2025-06-17 15:47, Greg KH wrote:
> On Wed, Jun 11, 2025 at 01:04:29PM +0200, Brett Sheffield wrote:
> > Longterm kernel 6.12.y backports commit:
> > 
> > - a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a "ipv6: save dontfrag in cork"
> 
> It's also in older kernels:
> 	5.10.238
> 	5.15.185
> 	6.1.141
> 	6.6.93
> 
> > but does not backport these related commits:
> > 
> > - 54580ccdd8a9c6821fd6f72171d435480867e4c3 "ipv6: remove leftover ip6 cookie initializer"
> > - 096208592b09c2f5fc0c1a174694efa41c04209d "ipv6: replace ipcm6_init calls with ipcm6_init_sk"
> > 
> > This causes a regression when sending IPv6 UDP packets by preventing
> > fragmentation and instead returning EMSGSIZE. I have attached a program which
> > demonstrates the issue.
> 
> Should we backport thse two to all of the other branches as well?

I have confirmed the regression is present in all of those older kernels (except
5.15.185 as that didn't boot on my test hardware - will look at that later).

The patch appears to have been autoselected for applying to the stable tree:

https://lore.kernel.org/all/?q=a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a

The patch follows on from a whole series of patches by Willem de Bruijn (CC), the
rest of which were not applied.

Unless there is a good reason for applying this patch in isolation, the quickest
fix is simply to revert that commit in stable and this fixes the regression.

Alternatives are:

1) apply a small fix for the regression (patch attached). This leaves a footgun
if you later decide to backport more of the series.

2) to backport and test the whole series of patches. See merge commit
aefd232de5eb2e77e3fc58c56486c7fe7426a228

3) In the case of 6.12.33, the two patches I referenced apply cleanly and are enough
to fix the problem.  There are conflicts on the other branches.

Unless there is a specific reason to have backported
a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a to stable I'd suggest just reverting
it.

Cheers,


Brett
-- 
Brett Sheffield (he/him)
Librecast - Decentralising the Internet with Multicast
https://librecast.net/
https://blog.brettsheffield.com/

[-- Attachment #2: 0001-ipv6-fix-udp-fragmentation.patch --]
[-- Type: text/plain, Size: 1183 bytes --]

From e5f970aa0e14471f0a8e6225705033219b63e4da Mon Sep 17 00:00:00 2001
From: Brett A C Sheffield <bacs@librecast.net>
Date: Tue, 17 Jun 2025 16:53:08 +0000
Subject: [PATCH] ipv6: fix udp fragmentation

A regression was introduced when backporting commit
a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a to the stable kernels without
applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

Fixes: c1502fc84d1c65e17ba25fcde1c52cbe52f79157
---
 net/ipv6/ip6_output.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 89a61e040e6a..82786e957f72 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1386,7 +1386,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 	}
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = READ_ONCE(np->pmtudisc) >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);

base-commit: e03ced99c437f4a7992b8fa3d97d598f55453fd0
-- 
2.49.0

Re: 6.12.y longterm regression - IPv6 UDP packet fragmentation

[Willem de Bruijn]

On Tue, Jun 17, 2025 at 1:29 PM Brett Sheffield <brett@librecast.net> wrote:
>
> Hi Greg,
>
> On 2025-06-17 15:47, Greg KH wrote:
> > On Wed, Jun 11, 2025 at 01:04:29PM +0200, Brett Sheffield wrote:
> > > Longterm kernel 6.12.y backports commit:
> > >
> > > - a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a "ipv6: save dontfrag in cork"
> >
> > It's also in older kernels:
> >       5.10.238
> >       5.15.185
> >       6.1.141
> >       6.6.93
> >
> > > but does not backport these related commits:
> > >
> > > - 54580ccdd8a9c6821fd6f72171d435480867e4c3 "ipv6: remove leftover ip6 cookie initializer"
> > > - 096208592b09c2f5fc0c1a174694efa41c04209d "ipv6: replace ipcm6_init calls with ipcm6_init_sk"
> > >
> > > This causes a regression when sending IPv6 UDP packets by preventing
> > > fragmentation and instead returning EMSGSIZE. I have attached a program which
> > > demonstrates the issue.

Thanks for the analysis. I had received a report and was looking into
it, but had not yet figured out this root cause.

> >
> > Should we backport thse two to all of the other branches as well?
>
> I have confirmed the regression is present in all of those older kernels (except
> 5.15.185 as that didn't boot on my test hardware - will look at that later).
>
> The patch appears to have been autoselected for applying to the stable tree:
>
> https://lore.kernel.org/all/?q=a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a
>
> The patch follows on from a whole series of patches by Willem de Bruijn (CC), the
> rest of which were not applied.
>
> Unless there is a good reason for applying this patch in isolation, the quickest
> fix is simply to revert that commit in stable and this fixes the regression.
>
> Alternatives are:
>
> 1) apply a small fix for the regression (patch attached). This leaves a footgun
> if you later decide to backport more of the series.
>
> 2) to backport and test the whole series of patches. See merge commit
> aefd232de5eb2e77e3fc58c56486c7fe7426a228
>
> 3) In the case of 6.12.33, the two patches I referenced apply cleanly and are enough
> to fix the problem.  There are conflicts on the other branches.
>
> Unless there is a specific reason to have backported
> a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a to stable I'd suggest just reverting
> it.

FWIW, I did not originally intend for these changes to make it to stable.

The simplest short term solution is to revert this patch out of the
stable trees. But long term that may give more conflicts as later
patches need to be backported? Not sure what is wiser in such cases.

Re: 6.12.y longterm regression - IPv6 UDP packet fragmentation

[Greg KH]

On Tue, Jun 17, 2025 at 02:25:02PM -0400, Willem de Bruijn wrote:
> On Tue, Jun 17, 2025 at 1:29 PM Brett Sheffield <brett@librecast.net> wrote:
> >
> > Hi Greg,
> >
> > On 2025-06-17 15:47, Greg KH wrote:
> > > On Wed, Jun 11, 2025 at 01:04:29PM +0200, Brett Sheffield wrote:
> > > > Longterm kernel 6.12.y backports commit:
> > > >
> > > > - a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a "ipv6: save dontfrag in cork"
> > >
> > > It's also in older kernels:
> > >       5.10.238
> > >       5.15.185
> > >       6.1.141
> > >       6.6.93
> > >
> > > > but does not backport these related commits:
> > > >
> > > > - 54580ccdd8a9c6821fd6f72171d435480867e4c3 "ipv6: remove leftover ip6 cookie initializer"
> > > > - 096208592b09c2f5fc0c1a174694efa41c04209d "ipv6: replace ipcm6_init calls with ipcm6_init_sk"
> > > >
> > > > This causes a regression when sending IPv6 UDP packets by preventing
> > > > fragmentation and instead returning EMSGSIZE. I have attached a program which
> > > > demonstrates the issue.
> 
> Thanks for the analysis. I had received a report and was looking into
> it, but had not yet figured out this root cause.
> 
> > >
> > > Should we backport thse two to all of the other branches as well?
> >
> > I have confirmed the regression is present in all of those older kernels (except
> > 5.15.185 as that didn't boot on my test hardware - will look at that later).
> >
> > The patch appears to have been autoselected for applying to the stable tree:
> >
> > https://lore.kernel.org/all/?q=a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a
> >
> > The patch follows on from a whole series of patches by Willem de Bruijn (CC), the
> > rest of which were not applied.
> >
> > Unless there is a good reason for applying this patch in isolation, the quickest
> > fix is simply to revert that commit in stable and this fixes the regression.
> >
> > Alternatives are:
> >
> > 1) apply a small fix for the regression (patch attached). This leaves a footgun
> > if you later decide to backport more of the series.
> >
> > 2) to backport and test the whole series of patches. See merge commit
> > aefd232de5eb2e77e3fc58c56486c7fe7426a228
> >
> > 3) In the case of 6.12.33, the two patches I referenced apply cleanly and are enough
> > to fix the problem.  There are conflicts on the other branches.
> >
> > Unless there is a specific reason to have backported
> > a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a to stable I'd suggest just reverting
> > it.
> 
> FWIW, I did not originally intend for these changes to make it to stable.
> 
> The simplest short term solution is to revert this patch out of the
> stable trees. But long term that may give more conflicts as later
> patches need to be backported? Not sure what is wiser in such cases.

For now, I've applied the above 2 to the 6.12.y tree.  They do not apply
any older.  If I should drop the change from the older stable trees,
please let me know.

thanks,

greg k-h

Re: 6.12.y longterm regression - IPv6 UDP packet fragmentation

[Brett Sheffield]

On 2025-06-22 11:10, Greg KH wrote:
> On Tue, Jun 17, 2025 at 02:25:02PM -0400, Willem de Bruijn wrote:
> > FWIW, I did not originally intend for these changes to make it to stable.
> > 
> > The simplest short term solution is to revert this patch out of the
> > stable trees. But long term that may give more conflicts as later
> > patches need to be backported? Not sure what is wiser in such cases.
> 
> For now, I've applied the above 2 to the 6.12.y tree.  They do not apply
> any older.  If I should drop the change from the older stable trees,
> please let me know.

Thanks Greg.

For the older stable trees I agree with Willem that reverting the patch is the
simplest fix.

As it stands UDP is broken in the older stable trees, so if this can make it
into the next stable release that would be a good thing.

Cheers,


Brett
-- 
Brett Sheffield (he/him)
Librecast - Decentralising the Internet with Multicast
https://librecast.net/
https://blog.brettsheffield.com/

Re: 6.12.y longterm regression - IPv6 UDP packet fragmentation

[Greg KH]

On Sun, Jun 22, 2025 at 11:37:53AM +0200, Brett Sheffield wrote:
> On 2025-06-22 11:10, Greg KH wrote:
> > On Tue, Jun 17, 2025 at 02:25:02PM -0400, Willem de Bruijn wrote:
> > > FWIW, I did not originally intend for these changes to make it to stable.
> > > 
> > > The simplest short term solution is to revert this patch out of the
> > > stable trees. But long term that may give more conflicts as later
> > > patches need to be backported? Not sure what is wiser in such cases.
> > 
> > For now, I've applied the above 2 to the 6.12.y tree.  They do not apply
> > any older.  If I should drop the change from the older stable trees,
> > please let me know.
> 
> Thanks Greg.
> 
> For the older stable trees I agree with Willem that reverting the patch is the
> simplest fix.
> 
> As it stands UDP is broken in the older stable trees, so if this can make it
> into the next stable release that would be a good thing.

Ok, can someone send me reverts for the needed branches?

thanks,

greg k-h

[PATCH 6.6.y] Revert "ipv6: save dontfrag in cork"

[Brett A C Sheffield]

From: Brett A C Sheffield (Librecast) <bacs@librecast.net>

This reverts commit 8ebf2709fe4dcd0a1b7b95bf61e529ddcd3cdf51 which is
commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a upstream.

A regression was introduced when backporting this to the stable kernels
without applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

As there is no compelling reason for this commit to be present in the
stable kernels it should be reverted.

Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
---
 include/linux/ipv6.h  | 1 -
 net/ipv6/ip6_output.c | 9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index d79851c5fabd..af8a771a053c 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -199,7 +199,6 @@ struct inet6_cork {
 	struct ipv6_txoptions *opt;
 	u8 hop_limit;
 	u8 tclass;
-	u8 dontfrag:1;
 };
 
 /* struct ipv6_pinfo - ipv6 private area */
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 28777b142240..c86d5dca29df 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1452,7 +1452,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 	}
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
@@ -1486,7 +1485,7 @@ static int __ip6_append_data(struct sock *sk,
 			     int getfrag(void *from, char *to, int offset,
 					 int len, int odd, struct sk_buff *skb),
 			     void *from, size_t length, int transhdrlen,
-			     unsigned int flags)
+			     unsigned int flags, struct ipcm6_cookie *ipc6)
 {
 	struct sk_buff *skb, *skb_prev = NULL;
 	struct inet_cork *cork = &cork_full->base;
@@ -1542,7 +1541,7 @@ static int __ip6_append_data(struct sock *sk,
 	if (headersize + transhdrlen > mtu)
 		goto emsgsize;
 
-	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
+	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
 	    (sk->sk_protocol == IPPROTO_UDP ||
 	     sk->sk_protocol == IPPROTO_ICMPV6 ||
 	     sk->sk_protocol == IPPROTO_RAW)) {
@@ -1914,7 +1913,7 @@ int ip6_append_data(struct sock *sk,
 
 	return __ip6_append_data(sk, &sk->sk_write_queue, &inet->cork,
 				 &np->cork, sk_page_frag(sk), getfrag,
-				 from, length, transhdrlen, flags);
+				 from, length, transhdrlen, flags, ipc6);
 }
 EXPORT_SYMBOL_GPL(ip6_append_data);
 
@@ -2119,7 +2118,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk,
 	err = __ip6_append_data(sk, &queue, cork, &v6_cork,
 				&current->task_frag, getfrag, from,
 				length + exthdrlen, transhdrlen + exthdrlen,
-				flags);
+				flags, ipc6);
 	if (err) {
 		__ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
 		return ERR_PTR(err);

base-commit: 3f5b4c104b7d3267d015daf9d9681c5fe3b01224
-- 
2.49.0

Patch "Revert "ipv6: save dontfrag in cork"" has been added to the 6.6-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    Revert "ipv6: save dontfrag in cork"

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     revert-ipv6-save-dontfrag-in-cork.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


From bacs@librecast.net  Wed Jul  2 16:20:41 2025
From: Brett A C Sheffield <bacs@librecast.net>
Date: Wed,  2 Jul 2025 13:37:32 +0200
Subject: Revert "ipv6: save dontfrag in cork"
To: gregkh@linuxfoundation.org
Cc: regressions@lists.linux.dev, stable@vger.kernel.org, willemb@google.com, Brett A C Sheffield <bacs@librecast.net>
Message-ID: <20250702113731.2322-2-bacs@librecast.net>


From: Brett A C Sheffield (Librecast) <bacs@librecast.net>

This reverts commit 8ebf2709fe4dcd0a1b7b95bf61e529ddcd3cdf51 which is
commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a upstream.

A regression was introduced when backporting this to the stable kernels
without applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

As there is no compelling reason for this commit to be present in the
stable kernels it should be reverted.

Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/ipv6.h  |    1 -
 net/ipv6/ip6_output.c |    9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -199,7 +199,6 @@ struct inet6_cork {
 	struct ipv6_txoptions *opt;
 	u8 hop_limit;
 	u8 tclass;
-	u8 dontfrag:1;
 };
 
 /* struct ipv6_pinfo - ipv6 private area */
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1452,7 +1452,6 @@ static int ip6_setup_cork(struct sock *s
 	}
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
@@ -1486,7 +1485,7 @@ static int __ip6_append_data(struct sock
 			     int getfrag(void *from, char *to, int offset,
 					 int len, int odd, struct sk_buff *skb),
 			     void *from, size_t length, int transhdrlen,
-			     unsigned int flags)
+			     unsigned int flags, struct ipcm6_cookie *ipc6)
 {
 	struct sk_buff *skb, *skb_prev = NULL;
 	struct inet_cork *cork = &cork_full->base;
@@ -1542,7 +1541,7 @@ static int __ip6_append_data(struct sock
 	if (headersize + transhdrlen > mtu)
 		goto emsgsize;
 
-	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
+	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
 	    (sk->sk_protocol == IPPROTO_UDP ||
 	     sk->sk_protocol == IPPROTO_ICMPV6 ||
 	     sk->sk_protocol == IPPROTO_RAW)) {
@@ -1914,7 +1913,7 @@ int ip6_append_data(struct sock *sk,
 
 	return __ip6_append_data(sk, &sk->sk_write_queue, &inet->cork,
 				 &np->cork, sk_page_frag(sk), getfrag,
-				 from, length, transhdrlen, flags);
+				 from, length, transhdrlen, flags, ipc6);
 }
 EXPORT_SYMBOL_GPL(ip6_append_data);
 
@@ -2119,7 +2118,7 @@ struct sk_buff *ip6_make_skb(struct sock
 	err = __ip6_append_data(sk, &queue, cork, &v6_cork,
 				&current->task_frag, getfrag, from,
 				length + exthdrlen, transhdrlen + exthdrlen,
-				flags);
+				flags, ipc6);
 	if (err) {
 		__ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
 		return ERR_PTR(err);


Patches currently in stable-queue which might be from bacs@librecast.net are

queue-6.6/revert-ipv6-save-dontfrag-in-cork.patch

Re: [PATCH 6.6.y] Revert "ipv6: save dontfrag in cork"

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a

WARNING: Author mismatch between patch and upstream commit:
Backport author: Brett A C Sheffield<bacs@librecast.net>
Commit author: Willem de Bruijn<willemb@google.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.12.y | Present (different SHA1: c1502fc84d1c)

Note: The patch differs from the upstream commit:
---
1:  a18dfa9925b9e ! 1:  5a27b7b998176 ipv6: save dontfrag in cork
    @@
      ## Metadata ##
    -Author: Willem de Bruijn <willemb@google.com>
    +Author: Brett A C Sheffield (Librecast) <bacs@librecast.net>
     
      ## Commit message ##
    -    ipv6: save dontfrag in cork
    +    Revert "ipv6: save dontfrag in cork"
     
    -    When spanning datagram construction over multiple send calls using
    -    MSG_MORE, per datagram settings are configured on the first send.
    +    This reverts commit 8ebf2709fe4dcd0a1b7b95bf61e529ddcd3cdf51 which is
    +    commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a upstream.
     
    -    That is when ip(6)_setup_cork stores these settings for subsequent use
    -    in __ip(6)_append_data and others.
    +    A regression was introduced when backporting this to the stable kernels
    +    without applying previous commits in this series.
     
    -    The only flag that escaped this was dontfrag. As a result, a datagram
    -    could be constructed with df=0 on the first sendmsg, but df=1 on a
    -    next. Which is what cmsg_ip.sh does in an upcoming MSG_MORE test in
    -    the "diff" scenario.
    +    When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
    +    instead of fragmenting the packets as expected.
     
    -    Changing datagram conditions in the middle of constructing an skb
    -    makes this already complex code path even more convoluted. It is here
    -    unintentional. Bring this flag in line with expected sockopt/cmsg
    -    behavior.
    +    As there is no compelling reason for this commit to be present in the
    +    stable kernels it should be reverted.
     
    -    And stop passing ipc6 to __ip6_append_data, to avoid such issues
    -    in the future. This is already the case for __ip_append_data.
    -
    -    inet6_cork had a 6 byte hole, so the 1B flag has no impact.
    -
    -    Signed-off-by: Willem de Bruijn <willemb@google.com>
    -    Reviewed-by: Eric Dumazet <edumazet@google.com>
    -    Link: https://patch.msgid.link/20250307033620.411611-3-willemdebruijn.kernel@gmail.com
    -    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    +    Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
     
      ## include/linux/ipv6.h ##
     @@ include/linux/ipv6.h: struct inet6_cork {
      	struct ipv6_txoptions *opt;
      	u8 hop_limit;
      	u8 tclass;
    -+	u8 dontfrag:1;
    +-	u8 dontfrag:1;
      };
      
      /* struct ipv6_pinfo - ipv6 private area */
    @@ net/ipv6/ip6_output.c: static int ip6_setup_cork(struct sock *sk, struct inet_co
      	}
      	v6_cork->hop_limit = ipc6->hlimit;
      	v6_cork->tclass = ipc6->tclass;
    -+	v6_cork->dontfrag = ipc6->dontfrag;
    +-	v6_cork->dontfrag = ipc6->dontfrag;
      	if (rt->dst.flags & DST_XFRM_TUNNEL)
    - 		mtu = READ_ONCE(np->pmtudisc) >= IPV6_PMTUDISC_PROBE ?
    + 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
      		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
     @@ net/ipv6/ip6_output.c: static int __ip6_append_data(struct sock *sk,
      			     int getfrag(void *from, char *to, int offset,
      					 int len, int odd, struct sk_buff *skb),
      			     void *from, size_t length, int transhdrlen,
    --			     unsigned int flags, struct ipcm6_cookie *ipc6)
    -+			     unsigned int flags)
    +-			     unsigned int flags)
    ++			     unsigned int flags, struct ipcm6_cookie *ipc6)
      {
      	struct sk_buff *skb, *skb_prev = NULL;
      	struct inet_cork *cork = &cork_full->base;
    @@ net/ipv6/ip6_output.c: static int __ip6_append_data(struct sock *sk,
      	if (headersize + transhdrlen > mtu)
      		goto emsgsize;
      
    --	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
    -+	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
    +-	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
    ++	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
      	    (sk->sk_protocol == IPPROTO_UDP ||
      	     sk->sk_protocol == IPPROTO_ICMPV6 ||
      	     sk->sk_protocol == IPPROTO_RAW)) {
    @@ net/ipv6/ip6_output.c: int ip6_append_data(struct sock *sk,
      
      	return __ip6_append_data(sk, &sk->sk_write_queue, &inet->cork,
      				 &np->cork, sk_page_frag(sk), getfrag,
    --				 from, length, transhdrlen, flags, ipc6);
    -+				 from, length, transhdrlen, flags);
    +-				 from, length, transhdrlen, flags);
    ++				 from, length, transhdrlen, flags, ipc6);
      }
      EXPORT_SYMBOL_GPL(ip6_append_data);
      
    @@ net/ipv6/ip6_output.c: struct sk_buff *ip6_make_skb(struct sock *sk,
      	err = __ip6_append_data(sk, &queue, cork, &v6_cork,
      				&current->task_frag, getfrag, from,
      				length + exthdrlen, transhdrlen + exthdrlen,
    --				flags, ipc6);
    -+				flags);
    +-				flags);
    ++				flags, ipc6);
      	if (err) {
      		__ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
      		return ERR_PTR(err);
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.6.y        |  Success    |  Success   |

[PATCH 5.15.y] Revert "ipv6: save dontfrag in cork"

[Brett A C Sheffield]

From: Brett A C Sheffield (Librecast) <bacs@librecast.net>

This reverts commit 2b572c40981138349c04b3f69220ac878a36c561 which is
commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a upstream.

A regression was introduced when backporting this to the stable kernels
without applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

As there is no compelling reason for this commit to be present in the
stable kernels it should be reverted.

Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
---
 include/linux/ipv6.h  | 1 -
 net/ipv6/ip6_output.c | 9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 5dfd663b70a2..b6fb76568b01 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -195,7 +195,6 @@ struct inet6_cork {
 	struct ipv6_txoptions *opt;
 	u8 hop_limit;
 	u8 tclass;
-	u8 dontfrag:1;
 };
 
 /**
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a71b7a106995..4fcff4fe5a98 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1428,7 +1428,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 	cork->fl.u.ip6 = *fl6;
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
@@ -1463,7 +1462,7 @@ static int __ip6_append_data(struct sock *sk,
 			     int getfrag(void *from, char *to, int offset,
 					 int len, int odd, struct sk_buff *skb),
 			     void *from, size_t length, int transhdrlen,
-			     unsigned int flags)
+			     unsigned int flags, struct ipcm6_cookie *ipc6)
 {
 	struct sk_buff *skb, *skb_prev = NULL;
 	unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu;
@@ -1520,7 +1519,7 @@ static int __ip6_append_data(struct sock *sk,
 	if (headersize + transhdrlen > mtu)
 		goto emsgsize;
 
-	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
+	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
 	    (sk->sk_protocol == IPPROTO_UDP ||
 	     sk->sk_protocol == IPPROTO_RAW)) {
 		ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
@@ -1837,7 +1836,7 @@ int ip6_append_data(struct sock *sk,
 
 	return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
 				 &np->cork, sk_page_frag(sk), getfrag,
-				 from, length, transhdrlen, flags);
+				 from, length, transhdrlen, flags, ipc6);
 }
 EXPORT_SYMBOL_GPL(ip6_append_data);
 
@@ -2032,7 +2031,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk,
 	err = __ip6_append_data(sk, fl6, &queue, &cork->base, &v6_cork,
 				&current->task_frag, getfrag, from,
 				length + exthdrlen, transhdrlen + exthdrlen,
-				flags);
+				flags, ipc6);
 	if (err) {
 		__ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
 		return ERR_PTR(err);

base-commit: 1c700860e8bc079c5c71d73c55e51865d273943c
-- 
2.49.0

Patch "Revert "ipv6: save dontfrag in cork"" has been added to the 5.15-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    Revert "ipv6: save dontfrag in cork"

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     revert-ipv6-save-dontfrag-in-cork.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


From bacs@librecast.net  Wed Jul  2 16:21:40 2025
From: Brett A C Sheffield <bacs@librecast.net>
Date: Wed,  2 Jul 2025 13:38:50 +0200
Subject: Revert "ipv6: save dontfrag in cork"
To: gregkh@linuxfoundation.org
Cc: regressions@lists.linux.dev, stable@vger.kernel.org, willemb@google.com, Brett A C Sheffield <bacs@librecast.net>
Message-ID: <20250702113849.2401-2-bacs@librecast.net>


From: Brett A C Sheffield (Librecast) <bacs@librecast.net>

This reverts commit 2b572c40981138349c04b3f69220ac878a36c561 which is
commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a upstream.

A regression was introduced when backporting this to the stable kernels
without applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

As there is no compelling reason for this commit to be present in the
stable kernels it should be reverted.

Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/ipv6.h  |    1 -
 net/ipv6/ip6_output.c |    9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -195,7 +195,6 @@ struct inet6_cork {
 	struct ipv6_txoptions *opt;
 	u8 hop_limit;
 	u8 tclass;
-	u8 dontfrag:1;
 };
 
 /**
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1428,7 +1428,6 @@ static int ip6_setup_cork(struct sock *s
 	cork->fl.u.ip6 = *fl6;
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
@@ -1463,7 +1462,7 @@ static int __ip6_append_data(struct sock
 			     int getfrag(void *from, char *to, int offset,
 					 int len, int odd, struct sk_buff *skb),
 			     void *from, size_t length, int transhdrlen,
-			     unsigned int flags)
+			     unsigned int flags, struct ipcm6_cookie *ipc6)
 {
 	struct sk_buff *skb, *skb_prev = NULL;
 	unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu;
@@ -1520,7 +1519,7 @@ static int __ip6_append_data(struct sock
 	if (headersize + transhdrlen > mtu)
 		goto emsgsize;
 
-	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
+	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
 	    (sk->sk_protocol == IPPROTO_UDP ||
 	     sk->sk_protocol == IPPROTO_RAW)) {
 		ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
@@ -1837,7 +1836,7 @@ int ip6_append_data(struct sock *sk,
 
 	return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
 				 &np->cork, sk_page_frag(sk), getfrag,
-				 from, length, transhdrlen, flags);
+				 from, length, transhdrlen, flags, ipc6);
 }
 EXPORT_SYMBOL_GPL(ip6_append_data);
 
@@ -2032,7 +2031,7 @@ struct sk_buff *ip6_make_skb(struct sock
 	err = __ip6_append_data(sk, fl6, &queue, &cork->base, &v6_cork,
 				&current->task_frag, getfrag, from,
 				length + exthdrlen, transhdrlen + exthdrlen,
-				flags);
+				flags, ipc6);
 	if (err) {
 		__ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
 		return ERR_PTR(err);


Patches currently in stable-queue which might be from bacs@librecast.net are

queue-5.15/revert-ipv6-save-dontfrag-in-cork.patch

Re: [PATCH 5.15.y] Revert "ipv6: save dontfrag in cork"

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a

WARNING: Author mismatch between patch and upstream commit:
Backport author: Brett A C Sheffield<bacs@librecast.net>
Commit author: Willem de Bruijn<willemb@google.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.12.y | Present (different SHA1: c1502fc84d1c)
6.6.y | Present (different SHA1: 8ebf2709fe4d)
6.1.y | Present (different SHA1: 4f809be95d9f)

Note: The patch differs from the upstream commit:
---
1:  a18dfa9925b9e < -:  ------------- ipv6: save dontfrag in cork
-:  ------------- > 1:  ec9c7e9fdf2a2 Revert "ipv6: save dontfrag in cork"
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.15.y       |  Success    |  Success   |

[PATCH 5.10.y] Revert "ipv6: save dontfrag in cork"

[Brett A C Sheffield]

From: Brett A C Sheffield (Librecast) <bacs@librecast.net>

This reverts commit 29533d1a54b8de5aaf8c4aa6790dc67d5c14fba5 which is
commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a upstream.

A regression was introduced when backporting this to the stable kernels
without applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

As there is no compelling reason for this commit to be present in the
stable kernels it should be reverted.

Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
---
 include/linux/ipv6.h  | 1 -
 net/ipv6/ip6_output.c | 9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 89b3527e0367..d758c131ed5e 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -189,7 +189,6 @@ struct inet6_cork {
 	struct ipv6_txoptions *opt;
 	u8 hop_limit;
 	u8 tclass;
-	u8 dontfrag:1;
 };
 
 /**
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index f024d89cb0f8..426330b8dfa4 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1416,7 +1416,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 	cork->fl.u.ip6 = *fl6;
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
@@ -1451,7 +1450,7 @@ static int __ip6_append_data(struct sock *sk,
 			     int getfrag(void *from, char *to, int offset,
 					 int len, int odd, struct sk_buff *skb),
 			     void *from, size_t length, int transhdrlen,
-			     unsigned int flags)
+			     unsigned int flags, struct ipcm6_cookie *ipc6)
 {
 	struct sk_buff *skb, *skb_prev = NULL;
 	unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu;
@@ -1508,7 +1507,7 @@ static int __ip6_append_data(struct sock *sk,
 	if (headersize + transhdrlen > mtu)
 		goto emsgsize;
 
-	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
+	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
 	    (sk->sk_protocol == IPPROTO_UDP ||
 	     sk->sk_protocol == IPPROTO_RAW)) {
 		ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
@@ -1826,7 +1825,7 @@ int ip6_append_data(struct sock *sk,
 
 	return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
 				 &np->cork, sk_page_frag(sk), getfrag,
-				 from, length, transhdrlen, flags);
+				 from, length, transhdrlen, flags, ipc6);
 }
 EXPORT_SYMBOL_GPL(ip6_append_data);
 
@@ -2021,7 +2020,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk,
 	err = __ip6_append_data(sk, fl6, &queue, &cork->base, &v6_cork,
 				&current->task_frag, getfrag, from,
 				length + exthdrlen, transhdrlen + exthdrlen,
-				flags);
+				flags, ipc6);
 	if (err) {
 		__ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
 		return ERR_PTR(err);

base-commit: ecbc622e0f5202e17a2f13dadb0900273faee0eb
-- 
2.49.0

Patch "Revert "ipv6: save dontfrag in cork"" has been added to the 5.10-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    Revert "ipv6: save dontfrag in cork"

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     revert-ipv6-save-dontfrag-in-cork.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


From bacs@librecast.net  Wed Jul  2 16:21:59 2025
From: Brett A C Sheffield <bacs@librecast.net>
Date: Wed,  2 Jul 2025 13:41:14 +0200
Subject: Revert "ipv6: save dontfrag in cork"
To: gregkh@linuxfoundation.org
Cc: regressions@lists.linux.dev, stable@vger.kernel.org, willemb@google.com, Brett A C Sheffield <bacs@librecast.net>
Message-ID: <20250702114113.2512-2-bacs@librecast.net>


From: Brett A C Sheffield (Librecast) <bacs@librecast.net>

This reverts commit 29533d1a54b8de5aaf8c4aa6790dc67d5c14fba5 which is
commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a upstream.

A regression was introduced when backporting this to the stable kernels
without applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

As there is no compelling reason for this commit to be present in the
stable kernels it should be reverted.

Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/ipv6.h  |    1 -
 net/ipv6/ip6_output.c |    9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -189,7 +189,6 @@ struct inet6_cork {
 	struct ipv6_txoptions *opt;
 	u8 hop_limit;
 	u8 tclass;
-	u8 dontfrag:1;
 };
 
 /**
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1416,7 +1416,6 @@ static int ip6_setup_cork(struct sock *s
 	cork->fl.u.ip6 = *fl6;
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
@@ -1451,7 +1450,7 @@ static int __ip6_append_data(struct sock
 			     int getfrag(void *from, char *to, int offset,
 					 int len, int odd, struct sk_buff *skb),
 			     void *from, size_t length, int transhdrlen,
-			     unsigned int flags)
+			     unsigned int flags, struct ipcm6_cookie *ipc6)
 {
 	struct sk_buff *skb, *skb_prev = NULL;
 	unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu;
@@ -1508,7 +1507,7 @@ static int __ip6_append_data(struct sock
 	if (headersize + transhdrlen > mtu)
 		goto emsgsize;
 
-	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
+	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
 	    (sk->sk_protocol == IPPROTO_UDP ||
 	     sk->sk_protocol == IPPROTO_RAW)) {
 		ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
@@ -1826,7 +1825,7 @@ int ip6_append_data(struct sock *sk,
 
 	return __ip6_append_data(sk, fl6, &sk->sk_write_queue, &inet->cork.base,
 				 &np->cork, sk_page_frag(sk), getfrag,
-				 from, length, transhdrlen, flags);
+				 from, length, transhdrlen, flags, ipc6);
 }
 EXPORT_SYMBOL_GPL(ip6_append_data);
 
@@ -2021,7 +2020,7 @@ struct sk_buff *ip6_make_skb(struct sock
 	err = __ip6_append_data(sk, fl6, &queue, &cork->base, &v6_cork,
 				&current->task_frag, getfrag, from,
 				length + exthdrlen, transhdrlen + exthdrlen,
-				flags);
+				flags, ipc6);
 	if (err) {
 		__ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
 		return ERR_PTR(err);


Patches currently in stable-queue which might be from bacs@librecast.net are

queue-5.10/revert-ipv6-save-dontfrag-in-cork.patch

Re: [PATCH 5.10.y] Revert "ipv6: save dontfrag in cork"

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a

WARNING: Author mismatch between patch and upstream commit:
Backport author: Brett A C Sheffield<bacs@librecast.net>
Commit author: Willem de Bruijn<willemb@google.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.12.y | Present (different SHA1: c1502fc84d1c)
6.6.y | Present (different SHA1: 8ebf2709fe4d)
6.1.y | Present (different SHA1: 4f809be95d9f)
5.15.y | Present (different SHA1: 2b572c409811)

Note: The patch differs from the upstream commit:
---
1:  a18dfa9925b9e < -:  ------------- ipv6: save dontfrag in cork
-:  ------------- > 1:  c6ed53575069f Revert "ipv6: save dontfrag in cork"
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y       |  Success    |  Success   |

[PATCH 6.1.y] Revert "ipv6: save dontfrag in cork"

[Brett A C Sheffield]

From: Brett A C Sheffield (Librecast) <bacs@librecast.net>

This reverts commit 4f809be95d9f3db13d31c574b8764c8d429f0c3b which is
commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a upstream.

A regression was introduced when backporting this to the stable kernels
without applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

As there is no compelling reason for this commit to be present in the
stable kernels it should be reverted.

Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
---
 include/linux/ipv6.h  | 1 -
 net/ipv6/ip6_output.c | 9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 9f27e004127b..9a44de45cc1f 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -199,7 +199,6 @@ struct inet6_cork {
 	struct ipv6_txoptions *opt;
 	u8 hop_limit;
 	u8 tclass;
-	u8 dontfrag:1;
 };
 
 /**
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index cfc276e5a249..f7a225da8525 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1450,7 +1450,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 	}
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
@@ -1484,7 +1483,7 @@ static int __ip6_append_data(struct sock *sk,
 			     int getfrag(void *from, char *to, int offset,
 					 int len, int odd, struct sk_buff *skb),
 			     void *from, size_t length, int transhdrlen,
-			     unsigned int flags)
+			     unsigned int flags, struct ipcm6_cookie *ipc6)
 {
 	struct sk_buff *skb, *skb_prev = NULL;
 	struct inet_cork *cork = &cork_full->base;
@@ -1540,7 +1539,7 @@ static int __ip6_append_data(struct sock *sk,
 	if (headersize + transhdrlen > mtu)
 		goto emsgsize;
 
-	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
+	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
 	    (sk->sk_protocol == IPPROTO_UDP ||
 	     sk->sk_protocol == IPPROTO_ICMPV6 ||
 	     sk->sk_protocol == IPPROTO_RAW)) {
@@ -1885,7 +1884,7 @@ int ip6_append_data(struct sock *sk,
 
 	return __ip6_append_data(sk, &sk->sk_write_queue, &inet->cork,
 				 &np->cork, sk_page_frag(sk), getfrag,
-				 from, length, transhdrlen, flags);
+				 from, length, transhdrlen, flags, ipc6);
 }
 EXPORT_SYMBOL_GPL(ip6_append_data);
 
@@ -2090,7 +2089,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk,
 	err = __ip6_append_data(sk, &queue, cork, &v6_cork,
 				&current->task_frag, getfrag, from,
 				length + exthdrlen, transhdrlen + exthdrlen,
-				flags);
+				flags, ipc6);
 	if (err) {
 		__ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
 		return ERR_PTR(err);

base-commit: 7e69c33e4858ea275b2e1c0bf0bea13199e7e91b
-- 
2.49.0

Patch "Revert "ipv6: save dontfrag in cork"" has been added to the 6.1-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    Revert "ipv6: save dontfrag in cork"

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     revert-ipv6-save-dontfrag-in-cork.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


From bacs@librecast.net  Wed Jul  2 16:21:13 2025
From: Brett A C Sheffield <bacs@librecast.net>
Date: Wed,  2 Jul 2025 13:41:51 +0200
Subject: Revert "ipv6: save dontfrag in cork"
To: gregkh@linuxfoundation.org
Cc: regressions@lists.linux.dev, stable@vger.kernel.org, willemb@google.com, Brett A C Sheffield <bacs@librecast.net>
Message-ID: <20250702114150.2590-2-bacs@librecast.net>


From: Brett A C Sheffield (Librecast) <bacs@librecast.net>

This reverts commit 4f809be95d9f3db13d31c574b8764c8d429f0c3b which is
commit a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a upstream.

A regression was introduced when backporting this to the stable kernels
without applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

As there is no compelling reason for this commit to be present in the
stable kernels it should be reverted.

Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 include/linux/ipv6.h  |    1 -
 net/ipv6/ip6_output.c |    9 ++++-----
 2 files changed, 4 insertions(+), 6 deletions(-)

--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -199,7 +199,6 @@ struct inet6_cork {
 	struct ipv6_txoptions *opt;
 	u8 hop_limit;
 	u8 tclass;
-	u8 dontfrag:1;
 };
 
 /**
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1450,7 +1450,6 @@ static int ip6_setup_cork(struct sock *s
 	}
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);
@@ -1484,7 +1483,7 @@ static int __ip6_append_data(struct sock
 			     int getfrag(void *from, char *to, int offset,
 					 int len, int odd, struct sk_buff *skb),
 			     void *from, size_t length, int transhdrlen,
-			     unsigned int flags)
+			     unsigned int flags, struct ipcm6_cookie *ipc6)
 {
 	struct sk_buff *skb, *skb_prev = NULL;
 	struct inet_cork *cork = &cork_full->base;
@@ -1540,7 +1539,7 @@ static int __ip6_append_data(struct sock
 	if (headersize + transhdrlen > mtu)
 		goto emsgsize;
 
-	if (cork->length + length > mtu - headersize && v6_cork->dontfrag &&
+	if (cork->length + length > mtu - headersize && ipc6->dontfrag &&
 	    (sk->sk_protocol == IPPROTO_UDP ||
 	     sk->sk_protocol == IPPROTO_ICMPV6 ||
 	     sk->sk_protocol == IPPROTO_RAW)) {
@@ -1885,7 +1884,7 @@ int ip6_append_data(struct sock *sk,
 
 	return __ip6_append_data(sk, &sk->sk_write_queue, &inet->cork,
 				 &np->cork, sk_page_frag(sk), getfrag,
-				 from, length, transhdrlen, flags);
+				 from, length, transhdrlen, flags, ipc6);
 }
 EXPORT_SYMBOL_GPL(ip6_append_data);
 
@@ -2090,7 +2089,7 @@ struct sk_buff *ip6_make_skb(struct sock
 	err = __ip6_append_data(sk, &queue, cork, &v6_cork,
 				&current->task_frag, getfrag, from,
 				length + exthdrlen, transhdrlen + exthdrlen,
-				flags);
+				flags, ipc6);
 	if (err) {
 		__ip6_flush_pending_frames(sk, &queue, cork, &v6_cork);
 		return ERR_PTR(err);


Patches currently in stable-queue which might be from bacs@librecast.net are

queue-6.1/revert-ipv6-save-dontfrag-in-cork.patch

Re: [PATCH 6.1.y] Revert "ipv6: save dontfrag in cork"

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

✅ All tests passed successfully. No issues detected.
No action required from the submitter.

The upstream commit SHA1 provided is correct: a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a

WARNING: Author mismatch between patch and upstream commit:
Backport author: Brett A C Sheffield<bacs@librecast.net>
Commit author: Willem de Bruijn<willemb@google.com>

Status in newer kernel trees:
6.15.y | Present (exact SHA1)
6.12.y | Present (different SHA1: c1502fc84d1c)
6.6.y | Present (different SHA1: 8ebf2709fe4d)

Note: The patch differs from the upstream commit:
---
1:  a18dfa9925b9e < -:  ------------- ipv6: save dontfrag in cork
-:  ------------- > 1:  ad1fd59a93836 Revert "ipv6: save dontfrag in cork"
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |