Re: [PATCH v2 net] net: skbuff: propagate shared-frag marker in skb_zerocopy()

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 22 Oct 2026 18:42:17 +0800 you wrote:
> skb_zerocopy() moves frag descriptors from @from into @to and takes a
> reference on each frag, but it does not copy skb_shinfo(from)->flags into
> skb_shinfo(to)->flags.  A destination skb holding the same page-cache
> backed frags as the source therefore reports skb_has_shared_frag() as
> false.
> 
> That breaks the invariant relied on by later in-place writers.  ESP input
> checks skb_has_shared_frag() before deciding whether an uncloned
> nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that
> skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is
> decrypted in place, letting an unprivileged user write into the page
> cache of a root-owned read-only file.
> 
> [...]

Here is the summary with links:
  - [v2,net] net: skbuff: propagate shared-frag marker in skb_zerocopy()
    https://git.kernel.org/netdev/net/c/79dc34beb1fd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html