From: Greg Kroah-Hartman Date: Fri, 8 May 2026 10:35:13 +0000 (+0200) Subject: xfrm patch added back for older kernels X-Git-Tag: v5.10.255~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=24ebaf099419d7b010c0fb199f68602e7b311eed;p=thirdparty%2Fkernel%2Fstable-queue.git xfrm patch added back for older kernels --- diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 0000000000..5af246ea7f --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1 @@ +xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch diff --git a/queue-5.10/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/queue-5.10/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch new file mode 100644 index 0000000000..2ff15434a1 --- /dev/null +++ b/queue-5.10/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch @@ -0,0 +1,87 @@ +From f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Mon Sep 17 00:00:00 2001 +From: Kuan-Ting Chen +Date: Mon, 4 May 2026 23:27:12 +0800 +Subject: xfrm: esp: avoid in-place decrypt on shared skb frags + +From: Kuan-Ting Chen + +commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 upstream. + +MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP +marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), +so later paths that may modify packet data can first make a private +copy. The IPv4/IPv6 datagram append paths did not set this flag when +splicing pages into UDP skbs. + +That leaves an ESP-in-UDP packet made from shared pipe pages looking +like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW +fast path for uncloned skbs without a frag_list and decrypts in place +over data that is not owned privately by the skb. + +Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching +TCP. Also make ESP input fall back to skb_cow_data() when the flag is +present, so ESP does not decrypt externally backed frags in place. +Private nonlinear skb frags still use the existing fast path. + +This intentionally does not change ESP output. In esp_output_head(), +the path that appends the ESP trailer to existing skb tailroom without +calling skb_cow_data() is not reachable for nonlinear skbs: +skb_tailroom() returns zero when skb->data_len is nonzero, while ESP +tailen is positive. Thus ESP output will either use the separate +destination-frag path or fall back to skb_cow_data(). + +Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") +Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") +Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") +Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") +Reported-by: Hyunwoo Kim +Reported-by: Kuan-Ting Chen +Tested-by: Hyunwoo Kim +Cc: stable@vger.kernel.org +Signed-off-by: Kuan-Ting Chen +Signed-off-by: Steffen Klassert +[bwh: Backported to 5.10: set the SKBTX_SHARED_FRAG flag in + ip_append_page() instead of __ip{,6}_append_data()] +Signed-off-by: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/esp4.c | 3 ++- + net/ipv4/ip_output.c | 2 ++ + net/ipv6/esp6.c | 3 ++- + 3 files changed, 6 insertions(+), 2 deletions(-) + +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -921,7 +921,8 @@ static int esp_input(struct xfrm_state * + nfrags = 1; + + goto skip_cow; +- } else if (!skb_has_frag_list(skb)) { ++ } else if (!skb_has_frag_list(skb) && ++ !skb_has_shared_frag(skb)) { + nfrags = skb_shinfo(skb)->nr_frags; + nfrags++; + +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1447,6 +1447,8 @@ ssize_t ip_append_page(struct sock *sk, + goto error; + } + ++ skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG; ++ + if (skb->ip_summed == CHECKSUM_NONE) { + __wsum csum; + csum = csum_page(page, offset, len); +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -966,7 +966,8 @@ static int esp6_input(struct xfrm_state + nfrags = 1; + + goto skip_cow; +- } else if (!skb_has_frag_list(skb)) { ++ } else if (!skb_has_frag_list(skb) && ++ !skb_has_shared_frag(skb)) { + nfrags = skb_shinfo(skb)->nr_frags; + nfrags++; + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 0000000000..5af246ea7f --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1 @@ +xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch diff --git a/queue-5.15/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/queue-5.15/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch new file mode 100644 index 0000000000..250cb3014f --- /dev/null +++ b/queue-5.15/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch @@ -0,0 +1,87 @@ +From f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Mon Sep 17 00:00:00 2001 +From: Kuan-Ting Chen +Date: Mon, 4 May 2026 23:27:12 +0800 +Subject: xfrm: esp: avoid in-place decrypt on shared skb frags + +From: Kuan-Ting Chen + +commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 upstream. + +MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP +marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), +so later paths that may modify packet data can first make a private +copy. The IPv4/IPv6 datagram append paths did not set this flag when +splicing pages into UDP skbs. + +That leaves an ESP-in-UDP packet made from shared pipe pages looking +like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW +fast path for uncloned skbs without a frag_list and decrypts in place +over data that is not owned privately by the skb. + +Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching +TCP. Also make ESP input fall back to skb_cow_data() when the flag is +present, so ESP does not decrypt externally backed frags in place. +Private nonlinear skb frags still use the existing fast path. + +This intentionally does not change ESP output. In esp_output_head(), +the path that appends the ESP trailer to existing skb tailroom without +calling skb_cow_data() is not reachable for nonlinear skbs: +skb_tailroom() returns zero when skb->data_len is nonzero, while ESP +tailen is positive. Thus ESP output will either use the separate +destination-frag path or fall back to skb_cow_data(). + +Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") +Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") +Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") +Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") +Reported-by: Hyunwoo Kim +Reported-by: Kuan-Ting Chen +Tested-by: Hyunwoo Kim +Cc: stable@vger.kernel.org +Signed-off-by: Kuan-Ting Chen +Signed-off-by: Steffen Klassert +[bwh: Backported to 6.1: set the SKBFL_SHARED_FRAG flag in + ip_append_page() instead of __ip{,6}_append_data()] +Signed-off-by: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/esp4.c | 3 ++- + net/ipv4/ip_output.c | 2 ++ + net/ipv6/esp6.c | 3 ++- + 3 files changed, 6 insertions(+), 2 deletions(-) + +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -921,7 +921,8 @@ static int esp_input(struct xfrm_state * + nfrags = 1; + + goto skip_cow; +- } else if (!skb_has_frag_list(skb)) { ++ } else if (!skb_has_frag_list(skb) && ++ !skb_has_shared_frag(skb)) { + nfrags = skb_shinfo(skb)->nr_frags; + nfrags++; + +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1443,6 +1443,8 @@ ssize_t ip_append_page(struct sock *sk, + goto error; + } + ++ skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; ++ + if (skb->ip_summed == CHECKSUM_NONE) { + __wsum csum; + csum = csum_page(page, offset, len); +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -968,7 +968,8 @@ static int esp6_input(struct xfrm_state + nfrags = 1; + + goto skip_cow; +- } else if (!skb_has_frag_list(skb)) { ++ } else if (!skb_has_frag_list(skb) && ++ !skb_has_shared_frag(skb)) { + nfrags = skb_shinfo(skb)->nr_frags; + nfrags++; + diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 0000000000..5af246ea7f --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1 @@ +xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch diff --git a/queue-6.1/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/queue-6.1/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch new file mode 100644 index 0000000000..7e1d5589e8 --- /dev/null +++ b/queue-6.1/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch @@ -0,0 +1,87 @@ +From f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Mon Sep 17 00:00:00 2001 +From: Kuan-Ting Chen +Date: Mon, 4 May 2026 23:27:12 +0800 +Subject: xfrm: esp: avoid in-place decrypt on shared skb frags + +From: Kuan-Ting Chen + +commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 upstream. + +MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP +marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), +so later paths that may modify packet data can first make a private +copy. The IPv4/IPv6 datagram append paths did not set this flag when +splicing pages into UDP skbs. + +That leaves an ESP-in-UDP packet made from shared pipe pages looking +like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW +fast path for uncloned skbs without a frag_list and decrypts in place +over data that is not owned privately by the skb. + +Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching +TCP. Also make ESP input fall back to skb_cow_data() when the flag is +present, so ESP does not decrypt externally backed frags in place. +Private nonlinear skb frags still use the existing fast path. + +This intentionally does not change ESP output. In esp_output_head(), +the path that appends the ESP trailer to existing skb tailroom without +calling skb_cow_data() is not reachable for nonlinear skbs: +skb_tailroom() returns zero when skb->data_len is nonzero, while ESP +tailen is positive. Thus ESP output will either use the separate +destination-frag path or fall back to skb_cow_data(). + +Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") +Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") +Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") +Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") +Reported-by: Hyunwoo Kim +Reported-by: Kuan-Ting Chen +Tested-by: Hyunwoo Kim +Cc: stable@vger.kernel.org +Signed-off-by: Kuan-Ting Chen +Signed-off-by: Steffen Klassert +[bwh: Backported to 6.1: set the SKBFL_SHARED_FRAG flag in + ip_append_page() instead of __ip{,6}_append_data()] +Signed-off-by: Ben Hutchings +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/esp4.c | 3 ++- + net/ipv4/ip_output.c | 2 ++ + net/ipv6/esp6.c | 3 ++- + 3 files changed, 6 insertions(+), 2 deletions(-) + +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -873,7 +873,8 @@ static int esp_input(struct xfrm_state * + nfrags = 1; + + goto skip_cow; +- } else if (!skb_has_frag_list(skb)) { ++ } else if (!skb_has_frag_list(skb) && ++ !skb_has_shared_frag(skb)) { + nfrags = skb_shinfo(skb)->nr_frags; + nfrags++; + +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1463,6 +1463,8 @@ ssize_t ip_append_page(struct sock *sk, + goto error; + } + ++ skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; ++ + if (skb->ip_summed == CHECKSUM_NONE) { + __wsum csum; + csum = csum_page(page, offset, len); +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -921,7 +921,8 @@ static int esp6_input(struct xfrm_state + nfrags = 1; + + goto skip_cow; +- } else if (!skb_has_frag_list(skb)) { ++ } else if (!skb_has_frag_list(skb) && ++ !skb_has_shared_frag(skb)) { + nfrags = skb_shinfo(skb)->nr_frags; + nfrags++; +