propagate shared-frag marker through frag-transfer helpers (original) (raw)

* [6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers @ 2026-05-22 17:21 Ben Hutchings 2026-05-23 4:21 ` Greg Kroah-Hartman 0 siblings, 1 reply; 5+ messages in thread From: Ben Hutchings @ 2026-05-22 17:21 UTC (permalink / raw) To: Greg Kroah-Hartman; +Cc: stable, Hyunwoo Kim, Paolo Abeni

[-- Attachment #1: Type: text/plain, Size: 519 bytes --]

Hi Greg,

I looked at the backport of commit 8f6a5356a33 queued for 6.6, and it's not quite right. The change that is supposed to be applied at the end of skb_gro_receive_list() is wrongly being applied at the end of skb_gro_receive() in the backport.

In 6.6 the skb_gro_receive_list() function does exist and it seems like the same change should be applied, but the function is in net/ipv4/udp_offload.c and not net/core/gro.c.

Ben.

-- Ben Hutchings Larkinson's Law: All laws are basically false.

[-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply [flat|nested] 5+ messages in thread

* Re: [6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers 2026-05-22 17:21 [6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers Ben Hutchings **@ 2026-05-23 4:21 Greg Kroah-Hartman** 2026-05-23 8:32 [PATCH 6.6] " Ben Hutchings 0 siblings, 1 reply; 5+ messages in thread From: Greg Kroah-Hartman @ 2026-05-23 4:21 UTC (permalink / raw) To: Ben Hutchings; +Cc: stable, Hyunwoo Kim, Paolo Abeni

On Fri, May 22, 2026 at 07:21:39PM +0200, Ben Hutchings wrote:

Hi Greg,

I looked at the backport of commit 8f6a5356a33 queued for 6.6, and it's not quite right. The change that is supposed to be applied at the end of skb_gro_receive_list() is wrongly being applied at the end of skb_gro_receive() in the backport.

In 6.6 the skb_gro_receive_list() function does exist and it seems like the same change should be applied, but the function is in net/ipv4/udp_offload.c and not net/core/gro.c.

Ick, ok, I'll go drop this, can you send a fixed up version instead?

thanks,

greg k-h

^ permalink raw reply [flat|nested] 5+ messages in thread

* [PATCH 6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers 2026-05-23 4:21 [Greg Kroah-Hartman](#m0ffee11df8b00a7a363dd05c1dafcb40d53360af) **@ 2026-05-23 8:32 Ben Hutchings** 2026-05-23 9:11 [Greg Kroah-Hartman](#m92a095bc79e7706cbeaedeee60d0a9b0163b188a) [not found] <20260523161843.1413146-1-guanwentao@uniontech.com> 0 siblings, 2 replies; 5+ messages in thread From: Ben Hutchings @ 2026-05-23 8:32 UTC (permalink / raw) To: Greg Kroah-Hartman; +Cc: stable, Hyunwoo Kim, Paolo Abeni

[-- Attachment #1: Type: text/plain, Size: 6890 bytes --]

From: Hyunwoo Kim imv4bel@gmail.com

commit 48f6a5356a33dd78e7144ae1faef95ffc990aae0 upstream.

Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. _pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false.

The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to ' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes.

Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change.

The same omission exists in skb_gro_receive() and skb_gro_receive_list(). The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both p and lp must carry the marker.

The same omission also exists in tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but a future consumer depending on the marker would regress silently.

The same omission exists in skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker.

Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") Suggested-by: Sabrina Dubroca sd@queasysnail.net Suggested-by: Sultan Alsawaf sultan@kerneltoast.com Suggested-by: Ben Hutchings ben@decadent.org.uk Suggested-by: Lin Ma malin89@huawei.com Suggested-by: Jingguo Tan tanjingguo@huawei.com Suggested-by: Aaron Esau aaron1esau@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Hyunwoo Kim imv4bel@gmail.com Tested-by: Rajat Gupta rajat.gupta@oss.qualcomm.com Link: https://patch.msgid.link/ageeJfJHwgzmKXbh@v4bel Signed-off-by: Paolo Abeni pabeni@redhat.com [bwh: Backported to 6.6: skb_gro_receive_list() is in net/ipv4/udp_offload.c here] Signed-off-by: Ben Hutchings benh@debian.org

net/core/gro.c | 2 ++ net/core/skbuff.c | 9 ++++++++- net/ipv4/tcp_output.c | 1 + net/ipv4/udp_offload.c | 2 ++ 4 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/net/core/gro.c b/net/core/gro.c index 92cb86d4ce50..0a9d4a3bb104 100644 --- a/net/core/gro.c +++ b/net/core/gro.c @@ -216,10 +216,12 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) p->data_len += len; p->truesize += delta_truesize; p->len += len; + skb_shinfo(p)->flags |= skbinfo->flags & SKBFL_SHARED_FRAG; if (lp != p) { lp->data_len += len; lp->truesize += delta_truesize; lp->len += len; + skb_shinfo(lp)->flags |= skbinfo->flags & SKBFL_SHARED_FRAG; } NAPI_GRO_CB(skb)->same_flow = 1; return 0; diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 88e0bf8004bf..8b05866e93b1 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2050,6 +2050,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom, skb_frag_ref(skb, i); } skb_shinfo(n)->nr_frags = i; + skb_shinfo(n)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; }

 if (skb_has_frag_list(skb)) {

@@ -4086,6 +4087,8 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen) tgt->ip_summed = CHECKSUM_PARTIAL; skb->ip_summed = CHECKSUM_PARTIAL;

@@ -4658,7 +4661,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, skb_copy_from_linear_data_offset(head_skb, offset, skb_put(nskb, hsize), hsize);

@@ -4675,6 +4679,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, nfrags = skb_shinfo(list_skb)->nr_frags; frag = skb_shinfo(list_skb)->frags; frag_skb = list_skb; + + skb_shinfo(nskb)->flags |= skb_shinfo(frag_skb)->flags & SKBFL_SHARED_FRAG; + if (!skb_headlen(list_skb)) { BUG_ON(!nfrags); } else { diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index db8f2830c67b..19e11b944db3 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2364,6 +2364,7 @@ static int tcp_clone_payload(struct sock *sk, struct sk_buff *to, todo = min_t(int, skb_frag_size(fragfrom), probe_size - len); len += todo; + skb_shinfo(to)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; if (lastfrag && skb_frag_page(fragfrom) == skb_frag_page(lastfrag) && skb_frag_off(fragfrom) == skb_frag_off(lastfrag) + diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index cd860d8d497b..84ae2759ff19 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -547,6 +547,8 @@ static int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb) p->truesize += skb->truesize; p->len += skb->len;

[-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --]

^ permalink raw reply related [flat|nested] 5+ messages in thread

* Re: [PATCH 6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers 2026-05-23 8:32 [[PATCH 6.6]](#m85c7f43532619a1b04aec18fdd98ee4604541ee8) " Ben Hutchings **@ 2026-05-23 9:11 Greg Kroah-Hartman** [not found] ` <20260523161843.1413146-1-guanwentao@uniontech.com> 1 sibling, 0 replies; 5+ messages in thread From: Greg Kroah-Hartman @ 2026-05-23 9:11 UTC (permalink / raw) To: Ben Hutchings; +Cc: stable, Hyunwoo Kim, Paolo Abeni

On Sat, May 23, 2026 at 10:32:23AM +0200, Ben Hutchings wrote:

From: Hyunwoo Kim imv4bel@gmail.com

commit 48f6a5356a33dd78e7144ae1faef95ffc990aae0 upstream.

Thanks, now queued up.

greg k-h

^ permalink raw reply [flat|nested] 5+ messages in thread

* Re: [PATCH 6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers [not found] <[f3814b420017094d314e76306cc433202b97865c.camel@debian.org](#r8c7f601f8b63d985150ecd183795bdeed88d650f)> **@ 2026-05-24 15:45 Wentao Guan** 0 siblings, 0 replies; 5+ messages in thread From: Wentao Guan @ 2026-05-24 15:45 UTC (permalink / raw) To: Ben Hutchings, Greg KH; +Cc: imv4bel, pabeni, stable

On Sun, 2026-05-24 at 00:18 +0800, Wentao Guan wrote:

Hello,

Why not apply commit 8928756d53d5 ("net: move skb_gro_receive_list from udp to core"), so commit 48f6a5356a33 ("net: skbuff: propagate shared-frag marker through frag-transfer helpers") will clean apply instead of change it.

Oh, yes that also works. I didn't notice that the first commit would apply cleanly here.

I forgot cc stable maillist when copy mail address, let me cc now.

BRs Wentao Guan

^ permalink raw reply [flat|nested] 5+ messages in thread

end of thread, other threads:[~2026-05-24 15:46 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-05-22 17:21 [6.6] net: skbuff: propagate shared-frag marker through frag-transfer helpers Ben Hutchings 2026-05-23 4:21 [Greg Kroah-Hartman](#m0ffee11df8b00a7a363dd05c1dafcb40d53360af) 2026-05-23 8:32 [PATCH 6.6] " Ben Hutchings 2026-05-23 9:11 [Greg Kroah-Hartman](#m92a095bc79e7706cbeaedeee60d0a9b0163b188a) [not found] <20260523161843.1413146-1-guanwentao@uniontech.com> [not found] <[f3814b420017094d314e76306cc433202b97865c.camel@debian.org](../../f3814b420017094d314e76306cc433202b97865c.camel@debian.org/)> 2026-05-24 15:45 Wentao Guan

This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).