From: Simon Horman <horms@kernel.org>
To: Julius Bairaktaris <julius@bairaktaris.de>
Cc: netdev@vger.kernel.org, dsahern@kernel.org, idosch@nvidia.com,
davem@davemloft.net, edumazet@kernel.org, kuba@kernel.org,
pabeni@redhat.com, steffen.klassert@secunet.com,
willemb@google.com, jiayuan.chen@linux.dev,
mfleming@cloudflare.com, almasrymina@google.com,
bigeasy@linutronix.de, richardbgobert@gmail.com,
ecree.xilinx@gmail.com, linux-kernel@vger.kernel.org
Subject: Re: [PATCH net v4 1/4] net: make room for the tunnel header in skb_segment_list()
Date: Tue, 3 Nov 2026 12:43:46 +0000 [thread overview]
Message-ID: <20261103124346.GJ865646@horms.kernel.org> (raw)
In-Reply-To: <b27640960edcb8e072fdd2e8d282c1deee747b8a.1792838740.git.julius@bairaktaris.de>
On Sun, Nov 01, 2026 at 05:42:29PM +0100, Julius Bairaktaris wrote:
> skb_segment_list() pushes each frag_list member back to the outer MAC
> header and copies the tunnel headers in front of it, but never checks
> that the member has the headroom. A fraglist GRO packet forwarded into
> a tunnel and segmented in software then hits skb_under_panic() on IPIP,
> and on VXLAN the copy writes before the member's head (KASAN:
> slab-out-of-bounds write in skb_segment_list()).
>
> Call skb_cow_head() on each member before pushing it.
>
> Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
> Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Reviewed-by: Simon Horman <horms@kernel.org>
next prev parent reply other threads:[~2026-11-03 12:43 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-01 16:42 [PATCH net v4 0/4] ipmr: forward GSO multicast packets Julius Bairaktaris
2026-11-01 16:42 ` [PATCH net v4 1/4] net: make room for the tunnel header in skb_segment_list() Julius Bairaktaris
2026-11-03 12:43 ` Simon Horman [this message]
2026-11-03 13:05 ` Eric Dumazet
2026-11-04 3:42 ` Henry Martin
2026-11-01 16:42 ` [PATCH net v4 2/4] net: gso: count the inner UDP header of encapsulated UDP GSO packets Julius Bairaktaris
2026-11-03 12:44 ` Simon Horman
2026-11-03 13:08 ` Eric Dumazet
2026-11-01 16:42 ` [PATCH net v4 3/4] ipmr: set up GSO state for tunnel vifs Julius Bairaktaris
2026-11-03 12:44 ` Simon Horman
2026-11-03 13:13 ` Eric Dumazet
2026-11-01 16:42 ` [PATCH net v4 4/4] ipmr: do not drop GSO packets that fit the MTU after segmentation Julius Bairaktaris
2026-11-03 12:44 ` Simon Horman
2026-11-03 13:15 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261103124346.GJ865646@horms.kernel.org \
--to=horms@kernel.org \
--cc=almasrymina@google.com \
--cc=bigeasy@linutronix.de \
--cc=davem@davemloft.net \
--cc=dsahern@kernel.org \
--cc=ecree.xilinx@gmail.com \
--cc=edumazet@kernel.org \
--cc=idosch@nvidia.com \
--cc=jiayuan.chen@linux.dev \
--cc=julius@bairaktaris.de \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mfleming@cloudflare.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=richardbgobert@gmail.com \
--cc=steffen.klassert@secunet.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.