Re: [PATCH net v2] net: skbuff: propagate shared-frag marker through frag-transfer helpers

[Hyunwoo Kim <imv4bel@gmail.com>]

On Fri, May 15, 2026 at 10:01:50AM +0800, Jiayuan Chen wrote:
> 
> On 5/14/26 5:23 PM, Hyunwoo Kim wrote:
> > On Wed, May 13, 2026 at 11:18:10PM -0700, Sultan Alsawaf wrote:
> > > On Thu, May 14, 2026 at 06:07:44AM +0900, Hyunwoo Kim wrote:
> > > > Changes in v2:
> > > > - Also propagate SHARED_FRAG in skb_shift()
> > > > - v1: https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/
> > > Hi Hyunwoo,
> > > 
> > > I've been working on mitigating this vulnerability as a member of the kernel
> > > team at CIQ, a distro vendor. In particular, we wanted to make sure that there
> > > weren't any lingering places missing SHARED_FRAG propagation.
> > > 
> > > To that end, I used Claude to discover that skb_gro_receive() remained unpatched
> > > (as you pointed out in the v1 thread). And then I generated a PoC exploiting the
> > > vulnerable skb_gro_receive() path.
> > > 
> > > The PoC is a modified version of the original fragnesia PoC. It works 100% of
> > > the time, just like the original fragnesia PoC.
> > > 
> > > I have attached the PoC and a patch that fixes skb_gro_receive(). Please take a
> > > look at them.
> > > 
> > > Thanks,
> > > Sultan
> > Nice catch. Thank you.
> > 
> > After testing, I plan to merge your patch with v2 into a single patch (not a
> > series) and submit it as v3. I would appreciate it if you could then add an
> > appropriate credit tag of your own.
> 
> When sending v3, remember to rebase net tree first then generate the patch.
> 
> https://web.git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f84eca5817390257cef78013d0112481c503b4a3

Thanks for the heads-up. I'll send v4 shortly. See also:
https://lore.kernel.org/all/agZEC3YDCAhkrcvr@v4bel/

Will rebase onto netdev before sending.


Best regards,
Hyunwoo Kim

> 
> 
> Thanks
> 
> > Also, I would appreciate it if you could use AI to explore additional
> > propagation variant paths. From my own analysis, no further ones have been
> > identified.
> > 
> > 
> > Best regards,
> > Hyunwoo Kim
> > 
> > 
> 
>