Re: [PATCH nf 0/2] ipvs: fix OOB write when NATing ICMPv6 errors quoting non-first fragments

[Ido Schimmel <idosch@nvidia.com>]

On Fri, Sep 25, 2026 at 08:50:58PM +0300, Julian Anastasov wrote:
> 
> 	Hello,
> 
> On Fri, 25 Sep 2026, Axel Mierczuk wrote:
> 
> > This series fixes a 16-byte OOB write past the verified skb area,
> > reachable through ICMPv6 errors that quote non-first fragments.
> > Following Julian's suggestion, it preserves ESP ICMPv6 handling.
> > 
> > Patch 1 includes the embedded IP header in ciph.len at both ICMPv6
> > call sites when parsing stops at a non-first fragment. The change
> > follows the ip_vs_fill_iph_skb_icmp() calls and does not depend on
> > patch 2.
> > 
> > Patch 2 makes ipv6_find_hdr() set *offset to the fragment payload
> > for non-first fragments when target < 0, so every successful return
> > updates it. It carries no Fixes tag because it defines an offset
> > that was previously unspecified.
> > 
> > Axel Mierczuk (2):
> >   ipvs: avoid out-of-bounds write in ip_vs_nat_icmp_v6
> >   ipv6: update *offset for non-first fragments in ipv6_find_hdr()
> > 
> >  net/ipv6/exthdrs_core.c         |  6 +++++-
> >  net/netfilter/ipvs/ip_vs_core.c | 14 ++++++++++++++
> >  2 files changed, 19 insertions(+), 1 deletion(-)
> 
> 	Both patches look good to me, thanks!
> 
> Acked-by: Julian Anastasov <ja@ssi.bg>
> 
> 	The ipv6 patch needs review from the net team and
> may need some Fixes line:
> 
> Fixes: b777e0ce7437 ("[NETFILTER]: make ipv6_find_hdr() find transport protocol header")

Doesn't patch 2 make patch 1 redundant? It seems that the comments added
by patch 1 become stale with patch 2, no?

If so, why do we need both? Why not send only patch 2 and blame
63dca2c0b0e7a?