Re: [PATCH net v2 1/1] ipv6: defrag: orphan skb before queuing

[Fernando Fernandez Mancera <fmancera@suse.de>]

On 10/2/26 11:25 AM, Ren Wei wrote:
> From: Zixuan Chai <petalzu987@gmail.com>
> 
> IPv4 and nf_conntrack fragment queues orphan skbs before returning
> -EINPROGRESS, but ip6_frag_queue() leaves the socket association intact.
> 
> A socket installed by bpf_sk_assign() may use SOCK_RCU_FREE and be released
> while its fragment remains queued. The skb destructor can then dereference
> a stale socket pointer.
> 
> Orphan the skb before returning -EINPROGRESS so the queued fragment no
> longer retains the socket association.
> 
> Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: LLM
> Signed-off-by: Zixuan Chai <petalzu987@gmail.com>
> Signed-off-by: Ren Wei <weir@nebusec.ai>
> ---
>   net/ipv6/reassembly.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
> index 05c51f669754..a7964125c764 100644
> --- a/net/ipv6/reassembly.c
> +++ b/net/ipv6/reassembly.c
> @@ -232,6 +232,7 @@ static int ip6_frag_queue(struct net *net,
>   	}
>   
>   	skb_dst_drop(skb);
> +	skb_orphan(skb);
>   	return -EINPROGRESS;
>   
>   insert_error:

Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>

Thanks,
Fernando.