Subject: Re: [PATCH net] tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

From: Jakub Kicinski <[email-masked]>
Date: Mon, 25 May 2026 11:20:11 -0700

On Sun, 24 May 2026 19:55:50 -0700 Kuniyuki Iwashima wrote:
> On Fri, May 22, 2026 at 4:55 AM Eric Dumazet <[email-masked]> wrote:
> >
> > In some cases, iptunnel_pmtud_check_icmp() can be called while
> > skb transport header is not set.
> >
> > This triggers an out-of-bound access, because
> > (typeof(skb->transport_header))~0U is 65535.
> >
> > Access the icmp header based on IPv4 network header,
> > after making sure icmp->type is present in skb linear part.
> >
> > Note that iptunnel_pmtud_check_icmpv6()) is fine.
> >
> > Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
> > Reported-by: Damiano Melotti <[email-masked]>
> > Signed-off-by: Eric Dumazet <[email-masked]>  
> 
> Reviewed-by: Kuniyuki Iwashima <[email-masked]>

Are we okay with what sashiko is reporting?
If it's legit it may be better to fix in one series