From: Jiayuan Chen <jiayuan.chen@linux•dev>
To: Hyunwoo Kim <imv4bel@gmail•com>, Sultan Alsawaf <sultan@kerneltoast•com>
Cc: davem@davemloft•net, edumazet@google•com, kuba@kernel•org,
pabeni@redhat•com, horms@kernel•org, kerneljasonxing@gmail•com,
kuniyu@google•com, mhal@rbox•co, steffen.klassert@secunet•com,
vakzz@zellic•io, ben@decadent•org.uk,
herbert@gondor•apana.org.au, dsahern@kernel•org,
netdev@vger•kernel.org, stable@vger•kernel.org
Subject: Re: [PATCH net v2] net: skbuff: propagate shared-frag marker through frag-transfer helpers
Date: Fri, 15 May 2026 10:01:50 +0800 [thread overview]
Message-ID: <f747602d-8208-4b3a-9e16-78632ec7b919@linux.dev> (raw)
In-Reply-To: <agWUdie1xBvBu22I@v4bel>
On 5/14/26 5:23 PM, Hyunwoo Kim wrote:
> On Wed, May 13, 2026 at 11:18:10PM -0700, Sultan Alsawaf wrote:
>> On Thu, May 14, 2026 at 06:07:44AM +0900, Hyunwoo Kim wrote:
>>> Changes in v2:
>>> - Also propagate SHARED_FRAG in skb_shift()
>>> - v1: https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/
>> Hi Hyunwoo,
>>
>> I've been working on mitigating this vulnerability as a member of the kernel
>> team at CIQ, a distro vendor. In particular, we wanted to make sure that there
>> weren't any lingering places missing SHARED_FRAG propagation.
>>
>> To that end, I used Claude to discover that skb_gro_receive() remained unpatched
>> (as you pointed out in the v1 thread). And then I generated a PoC exploiting the
>> vulnerable skb_gro_receive() path.
>>
>> The PoC is a modified version of the original fragnesia PoC. It works 100% of
>> the time, just like the original fragnesia PoC.
>>
>> I have attached the PoC and a patch that fixes skb_gro_receive(). Please take a
>> look at them.
>>
>> Thanks,
>> Sultan
> Nice catch. Thank you.
>
> After testing, I plan to merge your patch with v2 into a single patch (not a
> series) and submit it as v3. I would appreciate it if you could then add an
> appropriate credit tag of your own.
When sending v3, remember to rebase net tree first then generate the patch.
https://web.git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f84eca5817390257cef78013d0112481c503b4a3
Thanks
> Also, I would appreciate it if you could use AI to explore additional
> propagation variant paths. From my own analysis, no further ones have been
> identified.
>
>
> Best regards,
> Hyunwoo Kim
>
>
next prev parent reply other threads:[~2026-05-15 2:02 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-13 21:07 [PATCH net v2] net: skbuff: propagate shared-frag marker through frag-transfer helpers Hyunwoo Kim
2026-05-14 6:18 ` Sultan Alsawaf
2026-05-14 9:23 ` Hyunwoo Kim
2026-05-15 2:01 ` Jiayuan Chen [this message]
2026-05-15 2:34 ` Hyunwoo Kim
2026-05-14 8:04 ` Paolo Abeni
2026-05-14 9:38 ` Hyunwoo Kim
2026-05-14 10:21 ` Sabrina Dubroca
2026-05-14 14:37 ` David Ahern
2026-05-14 15:45 ` Sabrina Dubroca
2026-05-14 23:38 ` Jakub Kicinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f747602d-8208-4b3a-9e16-78632ec7b919@linux.dev \
--to=jiayuan.chen@linux$(echo .)dev \
--cc=ben@decadent$(echo .)org.uk \
--cc=davem@davemloft$(echo .)net \
--cc=dsahern@kernel$(echo .)org \
--cc=edumazet@google$(echo .)com \
--cc=herbert@gondor$(echo .)apana.org.au \
--cc=horms@kernel$(echo .)org \
--cc=imv4bel@gmail$(echo .)com \
--cc=kerneljasonxing@gmail$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=kuniyu@google$(echo .)com \
--cc=mhal@rbox$(echo .)co \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=stable@vger$(echo .)kernel.org \
--cc=steffen.klassert@secunet$(echo .)com \
--cc=sultan@kerneltoast$(echo .)com \
--cc=vakzz@zellic$(echo .)io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox