From: Jakub Kicinski Date: Sat, 8 Aug 2026 00:01:10 +0000 (-0700) Subject: Merge branch 'fix-skb-length-accounting-after-xdp-frag-adjustment' X-Git-Tag: v7.2~27^2~30 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d47b06aa3ea1c62540e422173b694dd028411528;p=thirdparty%2Fkernel%2Flinux.git Merge branch 'fix-skb-length-accounting-after-xdp-frag-adjustment' Sun Jian says: ==================== fix skb length accounting after XDP frag adjustment This series fixes skb length accounting after an XDP program adjusts its fragment area, in both the generic XDP path (net/core/dev.c) and the veth native path (drivers/net/veth.c). When the fragment area is resized, skb->len and skb->data_len can go out of sync, and in the reproduced UDP receive path this leaked skb_shared_info contents (including a kernel pointer) to userspace while truncating real payload. ==================== Link: https://patch.msgid.link/20260804054040.613675-1-sun.jian.kdev@gmail.com Signed-off-by: Jakub Kicinski --- d47b06aa3ea1c62540e422173b694dd028411528