Re: [PATCH net v2 1/1] ipv6: defrag: orphan skb before queuing
flat view
From: Fernando Fernandez Mancera <hidden>
Date: 2026-10-02 10:42:41
Also in:
bpf
On 10/2/26 11:25 AM, Ren Wei wrote:
quoted hunk ↗ jump to hunk
From: Zixuan Chai <redacted> IPv4 and nf_conntrack fragment queues orphan skbs before returning -EINPROGRESS, but ip6_frag_queue() leaves the socket association intact. A socket installed by bpf_sk_assign() may use SOCK_RCU_FREE and be released while its fragment remains queued. The skb destructor can then dereference a stale socket pointer. Orphan the skb before returning -EINPROGRESS so the queued fragment no longer retains the socket association. Fixes: cf7fbe660f2d ("bpf: Add socket assign support") Cc: stable@vger.kernel.org Reported-by: Vega <redacted> Assisted-by: LLM Signed-off-by: Zixuan Chai <redacted> Signed-off-by: Ren Wei <redacted> --- net/ipv6/reassembly.c | 1 + 1 file changed, 1 insertion(+)diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index 05c51f669754..a7964125c764 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c@@ -232,6 +232,7 @@ static int ip6_frag_queue(struct net *net, } skb_dst_drop(skb); + skb_orphan(skb); return -EINPROGRESS; insert_error:
Reviewed-by: Fernando Fernandez Mancera <redacted> Thanks, Fernando.