[PATCH net v2 0/3] net: hsr: fix shared-skb mutations in the forwarding path

[Xin Xie <xiexinet@gmail.com>]

During the review of the PRP RedBox v4 series (Simon Horman forwarding
the sashiko AI review), shared-skb-data mutation issues in the
existing HSR/PRP forwarding code were raised. They concern
pre-existing code, and we promised independent fixes for net. An
independent source audit then confirmed two distinct defect classes.
This series fixes both.

Patch 1/3 (interlink address mutations): on an HSR RedBox, frames
forwarded to the interlink arrive in hsr_xmit() as clones of a shared
skb. A tagged multicast or broadcast from a slave is also delivered
to the master through another clone of the same buffer, so the node
MAC written by hsr_deliver_master() and the RedBox MAC written by
hsr_xmit() land in the same six bytes; the local stack receives the
RedBox MAC instead of the originating node's. Master-originated
frames alias the original TX skb (taps may hold it), so the
master-origin substitutions and the RedBox rewrite would share data
too. The interlink-bound skb is now privatized with skb_cow() before
any address mutation: for all master-originated frames, and for ring
frames the master also consumes. On the hardware tag-insertion path,
the selected master-originated and locally consumed ring frames are
now isolated before the interlink address write. Ring frames the
master does not consume retain their existing zero-copy behavior and
pre-existing aliases; the pre-existing slave-side packet-tap alias is
explicitly not addressed here.

Patch 2/3 (path/LAN ID alias): hsr_create_tagged_frame() and
prp_create_tagged_frame() wrote the path/LAN ID into the received
skb's shared buffer and then skb_clone()d it per slave, so the
second slave's ID landed in the first slave's still-queued clone.
With a 200 ms netem delay, all 200 injected frames left slave A
carrying slave B's LAN ID. The helpers now clone first, privatize
with skb_cow(), reacquire the pointer, then write.

Patch 3/3 adds a regression selftest covering both classes:
pre-tagged PRP injection (base: 200/200 wrong-lan; patched:
isolated) and an HSR RedBox tagged-multicast case (base: the master
receives the RedBox MAC; patched: the master keeps the node MAC and
the interlink keeps the RedBox MAC).

Each code patch carries its own independently identified Fixes:
commit (5055cccfc2d1, RedBox introduction, v6.10; 451d8123f897, PRP
support, v5.9). The PRP RedBox v4 feature series is unaffected and
benefits when rebased.

Relationship with the in-flight GRO/GSO series ("net: hsr: fix
GRO/GSO super-packet handling", currently at v3,
https://lore.kernel.org/all/20260731090224.18-1-xiexinet@gmail.com/):
both series touch net/hsr/hsr_forward.c and the HSR selftest
Makefile; they verify as independent - full series applied in both
orders on current net (and the v2 selftest Makefile entry merges
with GRO's at their respective sorted positions); no textual or
semantic dependency.

Apply note: on net the series applies cleanly with plain git am. On
net-next, which already contains hsr_prp_redbox.sh in the HSR
selftest Makefile, the Makefile hunk of patch 3 needs git am's
three-way fallback (git am -3); the automatic merge inserts
hsr_shared_mutation.sh at its sorted position and the merged result
passes the upstream Makefile format validation.

Validation:

- both shared-skb mutation tests: the frozen v2 script (SHA-256
  9096d2c9050b052bc0355bce969fdea248382c90d92103f17b5e3cc32102a852),
  which differs from v1 only by the behavior-preserving CI edits
  listed in the changelog, failed on the base kernel and passed on the
  patched kernel
- independently reproduced and tagged on the v1 thread by Ali Ahmet
  Memis (Tested-by on the series, Reviewed-by on both code patches)

Changelog:

v1 -> v2 (patches 1/3 and 2/3 C payloads and technical descriptions
unchanged; identical patch-ids):
- carried trailers from the v1 thread: Reviewed-by and Tested-by of
  Ali Ahmet Memis <ali@iusegentoo.com> on both code patches;
- patch 3/3 selftest CI fixes only (no behavior change):
  - two SC2181 rewrites to direct exit-code checks,
  - register the new test at its sorted TEST_PROGS position,
  - rewrap the twelve >80-column lines reported by NIPA checkpatch;
- Cc the hsr_forward.c area authors and the v1 reviewer.

Previous postings (newest first):
v1: https://lore.kernel.org/all/20260728143604.26-1-xiexinet@gmail.com/

Xin Xie (3):
  net: hsr: privatize interlink-bound skbs before address mutation
  net: hsr: clone before updating path and LAN IDs in tagged frames
  selftests: net: hsr: add shared-mutation regression test

 net/hsr/hsr_forward.c                         |  51 +++-
 tools/testing/selftests/net/hsr/Makefile      |   1 +
 .../selftests/net/hsr/hsr_shared_mutation.sh  | 223 ++++++++++++++++++
 3 files changed, 270 insertions(+), 5 deletions(-)
 create mode 100755 tools/testing/selftests/net/hsr/hsr_shared_mutation.sh


base-commit: 2195424c3da2ef1829a63b807e3a900a90e57d85
-- 
2.43.0