Re: 6.12.y longterm regression - IPv6 UDP packet fragmentation

[Brett Sheffield <brett@librecast.net>]

[-- Attachment #1: Type: text/plain, Size: 2118 bytes --]

Hi Greg,

On 2025-06-17 15:47, Greg KH wrote:
> On Wed, Jun 11, 2025 at 01:04:29PM +0200, Brett Sheffield wrote:
> > Longterm kernel 6.12.y backports commit:
> > 
> > - a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a "ipv6: save dontfrag in cork"
> 
> It's also in older kernels:
> 	5.10.238
> 	5.15.185
> 	6.1.141
> 	6.6.93
> 
> > but does not backport these related commits:
> > 
> > - 54580ccdd8a9c6821fd6f72171d435480867e4c3 "ipv6: remove leftover ip6 cookie initializer"
> > - 096208592b09c2f5fc0c1a174694efa41c04209d "ipv6: replace ipcm6_init calls with ipcm6_init_sk"
> > 
> > This causes a regression when sending IPv6 UDP packets by preventing
> > fragmentation and instead returning EMSGSIZE. I have attached a program which
> > demonstrates the issue.
> 
> Should we backport thse two to all of the other branches as well?

I have confirmed the regression is present in all of those older kernels (except
5.15.185 as that didn't boot on my test hardware - will look at that later).

The patch appears to have been autoselected for applying to the stable tree:

https://lore.kernel.org/all/?q=a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a

The patch follows on from a whole series of patches by Willem de Bruijn (CC), the
rest of which were not applied.

Unless there is a good reason for applying this patch in isolation, the quickest
fix is simply to revert that commit in stable and this fixes the regression.

Alternatives are:

1) apply a small fix for the regression (patch attached). This leaves a footgun
if you later decide to backport more of the series.

2) to backport and test the whole series of patches. See merge commit
aefd232de5eb2e77e3fc58c56486c7fe7426a228

3) In the case of 6.12.33, the two patches I referenced apply cleanly and are enough
to fix the problem.  There are conflicts on the other branches.

Unless there is a specific reason to have backported
a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a to stable I'd suggest just reverting
it.

Cheers,


Brett
-- 
Brett Sheffield (he/him)
Librecast - Decentralising the Internet with Multicast
https://librecast.net/
https://blog.brettsheffield.com/

[-- Attachment #2: 0001-ipv6-fix-udp-fragmentation.patch --]
[-- Type: text/plain, Size: 1183 bytes --]

From e5f970aa0e14471f0a8e6225705033219b63e4da Mon Sep 17 00:00:00 2001
From: Brett A C Sheffield <bacs@librecast.net>
Date: Tue, 17 Jun 2025 16:53:08 +0000
Subject: [PATCH] ipv6: fix udp fragmentation

A regression was introduced when backporting commit
a18dfa9925b9ef6107ea3aa5814ca3c704d34a8a to the stable kernels without
applying previous commits in this series.

When sending IPv6 UDP packets larger than MTU, EMSGSIZE was returned
instead of fragmenting the packets as expected.

Fixes: c1502fc84d1c65e17ba25fcde1c52cbe52f79157
---
 net/ipv6/ip6_output.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 89a61e040e6a..82786e957f72 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1386,7 +1386,6 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork,
 	}
 	v6_cork->hop_limit = ipc6->hlimit;
 	v6_cork->tclass = ipc6->tclass;
-	v6_cork->dontfrag = ipc6->dontfrag;
 	if (rt->dst.flags & DST_XFRM_TUNNEL)
 		mtu = READ_ONCE(np->pmtudisc) >= IPV6_PMTUDISC_PROBE ?
 		      READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst);

base-commit: e03ced99c437f4a7992b8fa3d97d598f55453fd0
-- 
2.49.0