Re: [PATCH net v2 1/1] ipv4: reject undersized MTUs in ip_do_fragment()

[Ido Schimmel <idosch@nvidia.com>]

On Fri, Aug 14, 2026 at 01:35:26AM +0800, Ren Wei wrote:
> From: Yong Wang <edragain@163.com>
> 
> ip_do_fragment() subtracts the IPv4 header length from the effective
> MTU and passes the resulting payload MTU to ip_frag_next().
> 
> If the effective MTU is smaller than hlen + 8, ip_frag_next() rounds
> the fragment payload length down to zero. The fragmentation state then
> never makes forward progress: state->left, state->ptr and state->offset
> stay unchanged while ip_do_fragment() keeps allocating and transmitting
> header-only fragments until the softlockup detector fires.
> 
> This is reproducible with a route installed using "mtu lock 20", but it
> is also reproducible without route MTU lock, for example by forwarding a
> packet to a device whose MTU is 20.
> 
> Fix it in ip_do_fragment() by rejecting mtu < hlen + 8 with -EMSGSIZE,
> matching the existing IPv6 fragmentation check.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:GPT-5.4
> Signed-off-by: Yong Wang <edragain@163.com>
> Signed-off-by: Ren Wei <weir@nebusec.ai>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>