[PATCH net 0/3] net: hsr: fix shared-skb mutations in the forwarding path

[Xin Xie <xiexinet@gmail.com>]

During the review of the PRP RedBox v4 series (Simon Horman forwarding
the sashiko AI review), shared-skb-data mutation issues in the
existing HSR/PRP forwarding code were raised. They concern
pre-existing code, and we promised independent fixes for net. An
independent source audit then confirmed two distinct defect classes.
This series fixes both.

Patch 1/3 (interlink address mutations): on an HSR RedBox, frames
forwarded to the interlink arrive in hsr_xmit() as clones of a shared
skb. A tagged multicast or broadcast from a slave is also delivered
to the master through another clone of the same buffer, so the node
MAC written by hsr_deliver_master() and the RedBox MAC written by
hsr_xmit() land in the same six bytes; the local stack receives the
RedBox MAC instead of the originating node's. Master-originated
frames alias the original TX skb (taps may hold it), so the
master-origin substitutions and the RedBox rewrite would share data
too. The interlink-bound skb is now privatized with skb_cow() before
any address mutation: for all master-originated frames, and for ring
frames the master also consumes. On the hardware tag-insertion path,
the selected master-originated and locally consumed ring frames are
now isolated before the interlink address write. Ring frames the
master does not consume retain their existing zero-copy behavior and
pre-existing aliases; the pre-existing slave-side packet-tap alias is
explicitly not addressed here.

Patch 2/3 (path/LAN ID alias): hsr_create_tagged_frame() and
prp_create_tagged_frame() wrote the path/LAN ID into the received
skb's shared buffer and then skb_clone()d it per slave, so the
second slave's ID landed in the first slave's still-queued clone.
With a 200 ms netem delay, all 200 injected frames left slave A
carrying slave B's LAN ID. The helpers now clone first, privatize
with skb_cow(), reacquire the pointer, then write.

Patch 3/3 adds a regression selftest covering both classes:
pre-tagged PRP injection (base: 200/200 wrong-lan; patched:
isolated) and an HSR RedBox tagged-multicast case (base: the master
receives the RedBox MAC; patched: the master keeps the node MAC and
the interlink keeps the RedBox MAC).

Each code patch carries its own independently identified Fixes:
commit (5055cccfc2d1, RedBox introduction, v6.10; 451d8123f897, PRP
support, v5.9). The PRP RedBox v4 feature series is unaffected and
benefits when rebased.

Relationship with the in-flight GRO v2 series ("net: hsr: fix
GRO/GSO super-packet handling",
https://lore.kernel.org/all/20260724161253.79-1-xiexinet@gmail.com/):
full revised series vs full GRO v2 series verified applying cleanly
in both orders (selftest Makefile merges identically either way);
no textual or semantic dependency.

Validation (raw logs in the series' evidence archive):

- both shared-skb mutation tests: base failed, patched passed
- all executable HSR/PRP selftests of the base: pass
- create/delete loop x10: clean
- checkpatch --strict: 0 errors (one routine new-file MAINTAINERS note)
- W=1 base-vs-patched: allmodconfig + allyesconfig, 0 new warnings

Xin Xie (3):
  net: hsr: privatize interlink-bound skbs before address mutation
  net: hsr: clone before updating path and LAN IDs in tagged frames
  selftests: net: hsr: add shared-mutation regression test

 net/hsr/hsr_forward.c                         |  51 ++++-
 tools/testing/selftests/net/hsr/Makefile      |   1 +
 .../selftests/net/hsr/hsr_shared_mutation.sh  | 213 ++++++++++++++++++
 3 files changed, 260 insertions(+), 5 deletions(-)
 create mode 100755 tools/testing/selftests/net/hsr/hsr_shared_mutation.sh


base-commit: 53658c6f3682967a5e76ed4bc7462c4bdcddaec3
-- 
2.43.0