5.10-stable patches

added patches:
	xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch

diff --git a/queue-5.10/series b/queue-5.10/series
index d3bfb9149202ebbb6aec6fa91745d68fa37c94e1..f3a5d0215ec52e6e1a95649c08b3f4ac20bec19c 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -212,3 +212,4 @@ ipmi-si-return-state-to-normal-if-message-allocation-fails.patch
 fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-use-after-free.patch
 acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch
 spi-rockchip-fix-controller-deregistration.patch
+xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch

diff --git a/queue-5.10/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/queue-5.10/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch
new file mode 100644 (file)
index 0000000..2ff1543
--- /dev/null
+++ b/queue-5.10/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch
@@ -0,0 +1,87 @@
+From f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Mon Sep 17 00:00:00 2001
+From: Kuan-Ting Chen <h3xrabbit@gmail.com>
+Date: Mon, 4 May 2026 23:27:12 +0800
+Subject: xfrm: esp: avoid in-place decrypt on shared skb frags
+
+From: Kuan-Ting Chen <h3xrabbit@gmail.com>
+
+commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 upstream.
+
+MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP
+marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),
+so later paths that may modify packet data can first make a private
+copy. The IPv4/IPv6 datagram append paths did not set this flag when
+splicing pages into UDP skbs.
+
+That leaves an ESP-in-UDP packet made from shared pipe pages looking
+like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW
+fast path for uncloned skbs without a frag_list and decrypts in place
+over data that is not owned privately by the skb.
+
+Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching
+TCP. Also make ESP input fall back to skb_cow_data() when the flag is
+present, so ESP does not decrypt externally backed frags in place.
+Private nonlinear skb frags still use the existing fast path.
+
+This intentionally does not change ESP output. In esp_output_head(),
+the path that appends the ESP trailer to existing skb tailroom without
+calling skb_cow_data() is not reachable for nonlinear skbs:
+skb_tailroom() returns zero when skb->data_len is nonzero, while ESP
+tailen is positive. Thus ESP output will either use the separate
+destination-frag path or fall back to skb_cow_data().
+
+Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
+Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
+Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES")
+Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES")
+Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
+Reported-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
+Tested-by: Hyunwoo Kim <imv4bel@gmail.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
+Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+[bwh: Backported to 5.10: set the SKBTX_SHARED_FRAG flag in
+ ip_append_page() instead of __ip{,6}_append_data()]
+Signed-off-by: Ben Hutchings <benh@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/esp4.c      |    3 ++-
+ net/ipv4/ip_output.c |    2 ++
+ net/ipv6/esp6.c      |    3 ++-
+ 3 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/esp4.c
++++ b/net/ipv4/esp4.c
+@@ -921,7 +921,8 @@ static int esp_input(struct xfrm_state *
+                       nfrags = 1;
+ 
+                       goto skip_cow;
+-              } else if (!skb_has_frag_list(skb)) {
++              } else if (!skb_has_frag_list(skb) &&
++                         !skb_has_shared_frag(skb)) {
+                       nfrags = skb_shinfo(skb)->nr_frags;
+                       nfrags++;
+ 
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1447,6 +1447,8 @@ ssize_t  ip_append_page(struct sock *sk,
+                       goto error;
+               }
+ 
++              skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
++
+               if (skb->ip_summed == CHECKSUM_NONE) {
+                       __wsum csum;
+                       csum = csum_page(page, offset, len);
+--- a/net/ipv6/esp6.c
++++ b/net/ipv6/esp6.c
+@@ -966,7 +966,8 @@ static int esp6_input(struct xfrm_state
+                       nfrags = 1;
+ 
+                       goto skip_cow;
+-              } else if (!skb_has_frag_list(skb)) {
++              } else if (!skb_has_frag_list(skb) &&
++                         !skb_has_shared_frag(skb)) {
+                       nfrags = skb_shinfo(skb)->nr_frags;
+                       nfrags++;
+