Re: [PATCH nf 0/2] ipvs: fix OOB write when NATing ICMPv6 errors quoting non-first fragments

[Ido Schimmel <idosch@nvidia.com>]

On Wed, Sep 30, 2026 at 08:34:57PM +0300, Julian Anastasov wrote:
> 
> 	Hello,
> 
> On Mon, 28 Sep 2026, Ido Schimmel wrote:
> 
> > On Fri, Sep 25, 2026 at 08:50:58PM +0300, Julian Anastasov wrote:
> > > 
> > > > Axel Mierczuk (2):
> > > >   ipvs: avoid out-of-bounds write in ip_vs_nat_icmp_v6
> > > >   ipv6: update *offset for non-first fragments in ipv6_find_hdr()
> > > > 
> > > >  net/ipv6/exthdrs_core.c         |  6 +++++-
> > > >  net/netfilter/ipvs/ip_vs_core.c | 14 ++++++++++++++
> > > >  2 files changed, 19 insertions(+), 1 deletion(-)
> > > 
> > > 	Both patches look good to me, thanks!
> > > 
> > > Acked-by: Julian Anastasov <ja@ssi.bg>
> > > 
> > > 	The ipv6 patch needs review from the net team and
> > > may need some Fixes line:
> > > 
> > > Fixes: b777e0ce7437 ("[NETFILTER]: make ipv6_find_hdr() find transport protocol header")
> > 
> > Doesn't patch 2 make patch 1 redundant? It seems that the comments added
> > by patch 1 become stale with patch 2, no?
> > 
> > If so, why do we need both? Why not send only patch 2 and blame
> > 63dca2c0b0e7a?
> 
> 	The idea was to have IPVS fix that can be backported
> alone, if needed.

I assumed this was the case and it's your call, but then the appropriate
thing to do would be to wait with patch 2 until patch 1 is in net-next
and change it so that it removes the now dead code. At least that's how
I handle similar cases with my submissions.