[PATCH net v2 0/2] ipv4: fix fragment length accounting

[PATCH net v2 0/2] ipv4: fix fragment length accounting

[=?gb18030?B?dGVuY2VudG9zX3NlY3VyZShUZW5jZW50T1Owssiruau5stPKz+Qp?=]

This series corrects fragment length accounting in __ip_append_data().
Patch 1 reserves the XFRM bundle header space as headroom. Patch 2
rejects an append when the transport header and moved tail do not fit;
it also addresses the independently reachable ICMP Timestamp case.

Changes since the initial public posting:
- Patch 1: correct the skb->len/fraggap explanation, clarify IPv6's
  dst_exthdrlen terminology, and scope the layout comparison to the
  same skb setup inputs. Add Willem's Reviewed-by.
- Patch 2: describe the ICMP Timestamp corruption path, distinguish
  negative copy from unsigned pagedlen wrap, update the subject and
  Fixes tag, and remove the unrelated XFRM Reported-by.
- No code changes in either patch.

The patches remain based on v7.3-rc7 (f909e534f5e3). The unchanged code
was previously tested on x86_64 and arm64. The relevant selftests/net
subset on arm64 gave matching results on patched and pristine kernels,
including the same failures in pmtu.sh, xfrm_state.sh and ipsec.c.
For the ICMP Timestamp case, a patch-1-only kernel returned corrupted
timestamps, whereas a kernel with both patches returned no reply during
the receive timeout. No additional test run is claimed for this respin.

Previous posting:
https://lore.kernel.org/netdev/v2-20261026-cover@tencent.com/

Thanks for the review.

Anakin Zhang (2):
  net/ipv4: reserve exthdrlen as headroom instead of counting it in
    skb->len
  net/ipv4: reject appends with negative fragment copy

 net/ipv4/ip_output.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

-- 
2.55.0

Re: [PATCH net v2 0/2] ipv4: fix fragment length accounting

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 05 Nov 2026 15:34:36 +0800 you wrote:
> This series corrects fragment length accounting in __ip_append_data().
> Patch 1 reserves the XFRM bundle header space as headroom. Patch 2
> rejects an append when the transport header and moved tail do not fit;
> it also addresses the independently reachable ICMP Timestamp case.
> 
> Changes since the initial public posting:
> - Patch 1: correct the skb->len/fraggap explanation, clarify IPv6's
>   dst_exthdrlen terminology, and scope the layout comparison to the
>   same skb setup inputs. Add Willem's Reviewed-by.
> - Patch 2: describe the ICMP Timestamp corruption path, distinguish
>   negative copy from unsigned pagedlen wrap, update the subject and
>   Fixes tag, and remove the unrelated XFRM Reported-by.
> - No code changes in either patch.
> 
> [...]

Here is the summary with links:
  - [net,v2,2/2] net/ipv4: reject appends with negative fragment copy
    (no matching commit)
  - [net,v2,1/2] net/ipv4: reserve exthdrlen as headroom instead of counting it in skb->len
    https://git.kernel.org/netdev/net/c/0f47fce51a98

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html