Re: [PATCH net v2] net: skbuff: propagate shared-frag marker through frag-transfer helpers

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 5/14/26 5:23 PM, Hyunwoo Kim wrote:
> On Wed, May 13, 2026 at 11:18:10PM -0700, Sultan Alsawaf wrote:
>> On Thu, May 14, 2026 at 06:07:44AM +0900, Hyunwoo Kim wrote:
>>> Changes in v2:
>>> - Also propagate SHARED_FRAG in skb_shift()
>>> - v1: https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/
>> Hi Hyunwoo,
>>
>> I've been working on mitigating this vulnerability as a member of the kernel
>> team at CIQ, a distro vendor. In particular, we wanted to make sure that there
>> weren't any lingering places missing SHARED_FRAG propagation.
>>
>> To that end, I used Claude to discover that skb_gro_receive() remained unpatched
>> (as you pointed out in the v1 thread). And then I generated a PoC exploiting the
>> vulnerable skb_gro_receive() path.
>>
>> The PoC is a modified version of the original fragnesia PoC. It works 100% of
>> the time, just like the original fragnesia PoC.
>>
>> I have attached the PoC and a patch that fixes skb_gro_receive(). Please take a
>> look at them.
>>
>> Thanks,
>> Sultan
> Nice catch. Thank you.
>
> After testing, I plan to merge your patch with v2 into a single patch (not a
> series) and submit it as v3. I would appreciate it if you could then add an
> appropriate credit tag of your own.

When sending v3, remember to rebase net tree first then generate the patch.

https://web.git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f84eca5817390257cef78013d0112481c503b4a3


Thanks

> Also, I would appreciate it if you could use AI to explore additional
> propagation variant paths. From my own analysis, no further ones have been
> identified.
>
>
> Best regards,
> Hyunwoo Kim
>
>