A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

net: skbuff: preserve shared-frag marker during coalescing

Browse source 
skb_try_coalesce() can attach paged frags from @from to @to.  If @from
has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same
externally-owned or page-cache-backed frags, but the shared-frag marker
is currently lost.

That breaks the invariant relied on by later in-place writers.  In
particular, ESP input checks skb_has_shared_frag() before deciding
whether an uncloned nonlinear skb can skip skb_cow_data().  If TCP
receive coalescing has moved shared frags into an unmarked skb, ESP can
see skb_has_shared_frag() as false and decrypt in place over page-cache
backed frags.

Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged
frags.  The tailroom copy path does not need the marker because it copies
bytes into @to's linear data rather than transferring frag descriptors.

Fixes: cef401de7b ("net: fix possible wrong checksum generation")
Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags")
Signed-off-by: William Bowling <vakzz@zellic.io>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Tested-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260513041635.1289541-1-vakzz@zellic.io
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit f84eca5817390257cef78013d0112481c503b4a3)

Orabug: 39368828

Clean cherry-pick build needs a build fixup, on uek6/u3, shared-frag
state is carried in tx_flags(SKBTX_SHARED_FRAG), so propagate it when
frag ownership moves, and it doesn't have skb_shared_info.flags
SKBFL_SHARED_FRAG so accordingly adapted the patch. This is due to
missing 06b4feb37e64 (net: group skb_shinfo zerocopy related bits
together.) commit in UEK6U3.

Change-Id: I71564bc3a42d7523011705022a49393b63070fd5
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Reviewed-by: Joseph Salisbury <joseph.salisbury@oracle.com>
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
This commit is contained in:
William Bowling 2026-05-13 04:16:35 +00:00 • committed by Tashfin Shakeer Rhythm
commit 16656dc06d
No known key found for this signature in database
GPG key ID: 02FFCB5954E9A100
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
net/core/skbuff.c
View file

@ -5295,6 +5295,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
from_shinfo->frags,
from_shinfo->nr_frags * sizeof(skb_frag_t));
to_shinfo->nr_frags += from_shinfo->nr_frags;
if (from_shinfo->nr_frags)
to_shinfo->tx_flags |= from_shinfo->tx_flags & SKBTX_SHARED_FRAG;
if (!skb_cloned(from))
from_shinfo->nr_frags = 0;