Re: [PATCH net] net: lan743x: fix RX checksum use-after-free

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Sun, 13 Sep 2026 17:14:09 -0700 you wrote:

From: Mark Amirkan <redacted>

lan743x_rx_process_buffer() adds each non-first receive buffer to the
head skb's frag_list.  On the last descriptor, lan743x_rx_trim_skb()
linearizes the head and frees the fragment skb metadata.

The checksum-success path then writes ip_summed through the local skb
pointer, which still points to the final fragment.  This causes a
use-after-free write when a packet spans more than one receive buffer.

[...]

Here is the summary with links:
  - [net] net: lan743x: fix RX checksum use-after-free
    https://git.kernel.org/netdev/net/c/a9ce4053dc94

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html