Re: [RFC PATCH net-next] netfilter: bridge: refragment reassembled packets passed up

[Gabriel Goller <g.goller@proxmox.com>]

On 09.10.2026 15:04, netdev-bot+sinfo@kernel.org wrote:
> Hi!
> 
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
> 
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.
> 
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
> 
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

The issue was hit in production when bigger udp packets get ip-fragmented
and then hit a bridge with conntrack enabled. The bridge then reassembles the
packets for conntrack, but doesn't fragment them again (pass up instead of
forward, LOCAL_IN instead of POST_ROUTING hook), so they are dropped at the next
bridge because of the mtu.