Re: [PATCH net v5 2/4] net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
From: netdev-bot+sashiko@kernel.org
Date: 2026-09-04 10:57:40
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Critical: 0 · High: 0 · Medium: 0 · Low: 1 - [Low] Claim that the commit message's "Steps to reproduce (included in the new selftest)" references a selftest that does not exist in this… -- net: ipv6: Fix UDP length overflow with PMTU discover and big MTU The change clamps cork->base.fragsize to IP6_MAX_MTU in ip6_setup_cork() for UDP sockets, so a device MTU larger than IP6_MAX_MTU combined with IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE can no longer produce a 16-bit UDP length overflow. Raw IPv6 sockets are left alone so jumbograms keep working. Link: https://lore.kernel.org/netdev/6a6a966c.86abc875.e5c3d.0054.GAE@google.com/ (local)
quoted hunk ↗ jump to hunk
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index 8fc4766c8da90..5509650589915 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c@@ -1432,6 +1432,8 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, if (frag_size && frag_size < mtu) mtu = frag_size; + if (sk_is_udp(sk)) + mtu = min(mtu, IP6_MAX_MTU); cork->base.fragsize = mtu; cork->base.gso_size = ipc6->gso_size; cork->base.tx_flags = 0;
One note on the changelog rather than the code:
Steps to reproduce (included in the new selftest):
[Severity: Low] This turned out to be accurate, so no change is needed here; noting it only because the reference is forward-looking within the series. This commit only touches net/ipv6/ip6_output.c, so "the new selftest" is not present in this commit itself. The test is added by the later patch in the same series, "selftests: net: Test UDP length overflow with PMTU discover and big MTU", which creates tools/testing/selftests/net/cork_fragsize.py and adds it to TEST_PROGS in tools/testing/selftests/net/Makefile: + cork_fragsize.py \ The ipv6 variant of test_udp() there does set up a dummy netdev with an MTU above IP6_MAX_MTU, sets IPV6_MTU_DISCOVER to IPV6_PMTUDISC_DO, sends 65528 bytes and expects EMSGSIZE, and test_ipv6_jumbo() covers the raw socket jumbogram case mentioned in the last paragraph of the changelog. Would it be worth saying "included in a selftest added later in this series" so that anyone reading or backporting this commit alone knows where to look? -- Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260901195714.673548-1-alice.kernel%40fastmail.im