From: Greg Kroah-Hartman Date: Fri, 22 May 2026 09:27:14 +0000 (+0200) Subject: drop patch X-Git-Tag: v6.6.141~11 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5ffb022a62c6d0ecb81accddd5cffdd03f5368b3;p=thirdparty%2Fkernel%2Fstable-queue.git drop patch --- diff --git a/queue-5.10/net-skbuff-preserve-shared-frag-marker-during-coalescing.patch b/queue-5.10/net-skbuff-preserve-shared-frag-marker-during-coalescing.patch deleted file mode 100644 index 552e4e8403..0000000000 --- a/queue-5.10/net-skbuff-preserve-shared-frag-marker-during-coalescing.patch +++ /dev/null @@ -1,48 +0,0 @@ -From f84eca5817390257cef78013d0112481c503b4a3 Mon Sep 17 00:00:00 2001 -From: William Bowling -Date: Wed, 13 May 2026 04:16:35 +0000 -Subject: net: skbuff: preserve shared-frag marker during coalescing - -From: William Bowling - -commit f84eca5817390257cef78013d0112481c503b4a3 upstream. - -skb_try_coalesce() can attach paged frags from @from to @to. If @from -has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same -externally-owned or page-cache-backed frags, but the shared-frag marker -is currently lost. - -That breaks the invariant relied on by later in-place writers. In -particular, ESP input checks skb_has_shared_frag() before deciding -whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP -receive coalescing has moved shared frags into an unmarked skb, ESP can -see skb_has_shared_frag() as false and decrypt in place over page-cache -backed frags. - -Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged -frags. The tailroom copy path does not need the marker because it copies -bytes into @to's linear data rather than transferring frag descriptors. - -Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") -Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") -Signed-off-by: William Bowling -Reviewed-by: Eric Dumazet -Tested-by: Jiayuan Chen -Link: https://patch.msgid.link/20260513041635.1289541-1-vakzz@zellic.io -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman ---- - net/core/skbuff.c | 2 ++ - 1 file changed, 2 insertions(+) - ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -5315,6 +5315,8 @@ bool skb_try_coalesce(struct sk_buff *to - from_shinfo->frags, - from_shinfo->nr_frags * sizeof(skb_frag_t)); - to_shinfo->nr_frags += from_shinfo->nr_frags; -+ if (from_shinfo->nr_frags) -+ to_shinfo->flags |= from_shinfo->flags & SKBFL_SHARED_FRAG; - - if (!skb_cloned(from)) - from_shinfo->nr_frags = 0; diff --git a/queue-5.10/series b/queue-5.10/series index 088e6e54fd..f1397069dd 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -527,4 +527,3 @@ drm-panfrost-fix-wait_bo-ioctl-leaking-positive-return-from-dma_resv_wait_timeou drm-gma500-oaktrail_hdmi-fix-i2c-adapter-leak-on-setup.patch io-wq-check-that-the-predecessor-is-hashed-in-io_wq_remove_pending.patch net-rds-reset-op_nents-when-zerocopy-page-pin-fails.patch -net-skbuff-preserve-shared-frag-marker-during-coalescing.patch