From: Greg Kroah-Hartman Date: Fri, 8 May 2026 10:58:31 +0000 (+0200) Subject: drop already applied patch X-Git-Tag: v5.15.206~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b006b90e21f13081695b9e326f696178c94ed24d;p=thirdparty%2Fkernel%2Fstable-queue.git drop already applied patch --- diff --git a/queue-5.10/series b/queue-5.10/series index f3a5d0215e..d3bfb91492 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -212,4 +212,3 @@ ipmi-si-return-state-to-normal-if-message-allocation-fails.patch fbdev-udlfb-add-vm_ops-to-dlfb_ops_mmap-to-prevent-use-after-free.patch acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch spi-rockchip-fix-controller-deregistration.patch -xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch diff --git a/queue-5.10/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/queue-5.10/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch deleted file mode 100644 index 2ff15434a1..0000000000 --- a/queue-5.10/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch +++ /dev/null @@ -1,87 +0,0 @@ -From f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Mon Sep 17 00:00:00 2001 -From: Kuan-Ting Chen -Date: Mon, 4 May 2026 23:27:12 +0800 -Subject: xfrm: esp: avoid in-place decrypt on shared skb frags - -From: Kuan-Ting Chen - -commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 upstream. - -MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP -marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), -so later paths that may modify packet data can first make a private -copy. The IPv4/IPv6 datagram append paths did not set this flag when -splicing pages into UDP skbs. - -That leaves an ESP-in-UDP packet made from shared pipe pages looking -like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW -fast path for uncloned skbs without a frag_list and decrypts in place -over data that is not owned privately by the skb. - -Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching -TCP. Also make ESP input fall back to skb_cow_data() when the flag is -present, so ESP does not decrypt externally backed frags in place. -Private nonlinear skb frags still use the existing fast path. - -This intentionally does not change ESP output. In esp_output_head(), -the path that appends the ESP trailer to existing skb tailroom without -calling skb_cow_data() is not reachable for nonlinear skbs: -skb_tailroom() returns zero when skb->data_len is nonzero, while ESP -tailen is positive. Thus ESP output will either use the separate -destination-frag path or fall back to skb_cow_data(). - -Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") -Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") -Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") -Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") -Reported-by: Hyunwoo Kim -Reported-by: Kuan-Ting Chen -Tested-by: Hyunwoo Kim -Cc: stable@vger.kernel.org -Signed-off-by: Kuan-Ting Chen -Signed-off-by: Steffen Klassert -[bwh: Backported to 5.10: set the SKBTX_SHARED_FRAG flag in - ip_append_page() instead of __ip{,6}_append_data()] -Signed-off-by: Ben Hutchings -Signed-off-by: Greg Kroah-Hartman ---- - net/ipv4/esp4.c | 3 ++- - net/ipv4/ip_output.c | 2 ++ - net/ipv6/esp6.c | 3 ++- - 3 files changed, 6 insertions(+), 2 deletions(-) - ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -921,7 +921,8 @@ static int esp_input(struct xfrm_state * - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1447,6 +1447,8 @@ ssize_t ip_append_page(struct sock *sk, - goto error; - } - -+ skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG; -+ - if (skb->ip_summed == CHECKSUM_NONE) { - __wsum csum; - csum = csum_page(page, offset, len); ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -966,7 +966,8 @@ static int esp6_input(struct xfrm_state - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - diff --git a/queue-5.15/series b/queue-5.15/series index bcda76c33a..e869dc6e4b 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -281,4 +281,3 @@ acpi-scan-use-acpi_dev_put-in-object-add-error-paths.patch acpi-cppc-fix-related_cpus-inconsistency-during-cpu-hotplug.patch acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch spi-rockchip-fix-controller-deregistration.patch -xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch diff --git a/queue-5.15/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/queue-5.15/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch deleted file mode 100644 index 250cb3014f..0000000000 --- a/queue-5.15/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch +++ /dev/null @@ -1,87 +0,0 @@ -From f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Mon Sep 17 00:00:00 2001 -From: Kuan-Ting Chen -Date: Mon, 4 May 2026 23:27:12 +0800 -Subject: xfrm: esp: avoid in-place decrypt on shared skb frags - -From: Kuan-Ting Chen - -commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 upstream. - -MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP -marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), -so later paths that may modify packet data can first make a private -copy. The IPv4/IPv6 datagram append paths did not set this flag when -splicing pages into UDP skbs. - -That leaves an ESP-in-UDP packet made from shared pipe pages looking -like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW -fast path for uncloned skbs without a frag_list and decrypts in place -over data that is not owned privately by the skb. - -Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching -TCP. Also make ESP input fall back to skb_cow_data() when the flag is -present, so ESP does not decrypt externally backed frags in place. -Private nonlinear skb frags still use the existing fast path. - -This intentionally does not change ESP output. In esp_output_head(), -the path that appends the ESP trailer to existing skb tailroom without -calling skb_cow_data() is not reachable for nonlinear skbs: -skb_tailroom() returns zero when skb->data_len is nonzero, while ESP -tailen is positive. Thus ESP output will either use the separate -destination-frag path or fall back to skb_cow_data(). - -Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") -Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") -Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") -Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") -Reported-by: Hyunwoo Kim -Reported-by: Kuan-Ting Chen -Tested-by: Hyunwoo Kim -Cc: stable@vger.kernel.org -Signed-off-by: Kuan-Ting Chen -Signed-off-by: Steffen Klassert -[bwh: Backported to 6.1: set the SKBFL_SHARED_FRAG flag in - ip_append_page() instead of __ip{,6}_append_data()] -Signed-off-by: Ben Hutchings -Signed-off-by: Greg Kroah-Hartman ---- - net/ipv4/esp4.c | 3 ++- - net/ipv4/ip_output.c | 2 ++ - net/ipv6/esp6.c | 3 ++- - 3 files changed, 6 insertions(+), 2 deletions(-) - ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -921,7 +921,8 @@ static int esp_input(struct xfrm_state * - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1443,6 +1443,8 @@ ssize_t ip_append_page(struct sock *sk, - goto error; - } - -+ skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; -+ - if (skb->ip_summed == CHECKSUM_NONE) { - __wsum csum; - csum = csum_page(page, offset, len); ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -968,7 +968,8 @@ static int esp6_input(struct xfrm_state - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - diff --git a/queue-6.1/series b/queue-6.1/series index 5715bff233..82af31ff39 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -286,4 +286,3 @@ acpi-cppc-fix-related_cpus-inconsistency-during-cpu-hotplug.patch acpi-video-force-native-backlight-on-hp-omen-16-8a44.patch asoc-sof-don-t-allow-pointer-operations-on-unconfigured-streams.patch spi-rockchip-fix-controller-deregistration.patch -xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch diff --git a/queue-6.1/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/queue-6.1/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch deleted file mode 100644 index 7e1d5589e8..0000000000 --- a/queue-6.1/xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch +++ /dev/null @@ -1,87 +0,0 @@ -From f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Mon Sep 17 00:00:00 2001 -From: Kuan-Ting Chen -Date: Mon, 4 May 2026 23:27:12 +0800 -Subject: xfrm: esp: avoid in-place decrypt on shared skb frags - -From: Kuan-Ting Chen - -commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 upstream. - -MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP -marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), -so later paths that may modify packet data can first make a private -copy. The IPv4/IPv6 datagram append paths did not set this flag when -splicing pages into UDP skbs. - -That leaves an ESP-in-UDP packet made from shared pipe pages looking -like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW -fast path for uncloned skbs without a frag_list and decrypts in place -over data that is not owned privately by the skb. - -Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching -TCP. Also make ESP input fall back to skb_cow_data() when the flag is -present, so ESP does not decrypt externally backed frags in place. -Private nonlinear skb frags still use the existing fast path. - -This intentionally does not change ESP output. In esp_output_head(), -the path that appends the ESP trailer to existing skb tailroom without -calling skb_cow_data() is not reachable for nonlinear skbs: -skb_tailroom() returns zero when skb->data_len is nonzero, while ESP -tailen is positive. Thus ESP output will either use the separate -destination-frag path or fall back to skb_cow_data(). - -Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") -Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") -Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") -Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") -Reported-by: Hyunwoo Kim -Reported-by: Kuan-Ting Chen -Tested-by: Hyunwoo Kim -Cc: stable@vger.kernel.org -Signed-off-by: Kuan-Ting Chen -Signed-off-by: Steffen Klassert -[bwh: Backported to 6.1: set the SKBFL_SHARED_FRAG flag in - ip_append_page() instead of __ip{,6}_append_data()] -Signed-off-by: Ben Hutchings -Signed-off-by: Greg Kroah-Hartman ---- - net/ipv4/esp4.c | 3 ++- - net/ipv4/ip_output.c | 2 ++ - net/ipv6/esp6.c | 3 ++- - 3 files changed, 6 insertions(+), 2 deletions(-) - ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -873,7 +873,8 @@ static int esp_input(struct xfrm_state * - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1463,6 +1463,8 @@ ssize_t ip_append_page(struct sock *sk, - goto error; - } - -+ skb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG; -+ - if (skb->ip_summed == CHECKSUM_NONE) { - __wsum csum; - csum = csum_page(page, offset, len); ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -921,7 +921,8 @@ static int esp6_input(struct xfrm_state - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; -