[PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Hyunwoo Kim]

The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true.  An skb
that is not cloned but still carries externally-owned paged fragments
(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
__ip_append_data, or a chained skb_has_frag_list()) falls through to
the in-place decryption path, which binds the frag pages directly into
the AEAD/skcipher SGL via skb_to_sgvec().

Extend the gate to also unshare when skb_has_frag_list() or
skb_has_shared_frag() is true.  This catches the splice-loopback vector
and other externally-shared frag sources while preserving the
zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
page_pool RX, GRO).  The OOM/trace handling already in place is reused.

Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()")
Cc: stable@vger.kernel.org
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
---
Changes in v3:
- Use skb_has_frag_list() || skb_has_shared_frag() instead of skb_is_nonlinear()
- v2: https://lore.kernel.org/all/af2F1FU5d4Q_Gn1W@v4bel/
Changes in v2:
- Use skb_is_nonlinear() instead of skb->data_len
- v1: https://lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel/
---
 net/rxrpc/call_event.c | 4 +++-
 net/rxrpc/conn_event.c | 3 ++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index fdd683261226..2b19b252225e 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -334,7 +334,9 @@ bool rxrpc_input_call_event(struct rxrpc_call *call)
 
 			if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
 			    sp->hdr.securityIndex != 0 &&
-			    skb_cloned(skb)) {
+			    (skb_cloned(skb) ||
+			     skb_has_frag_list(skb) ||
+			     skb_has_shared_frag(skb))) {
 				/* Unshare the packet so that it can be
 				 * modified by in-place decryption.
 				 */
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index a2130d25aaa9..442414d90ba1 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -245,7 +245,8 @@ static int rxrpc_verify_response(struct rxrpc_connection *conn,
 {
 	int ret;
 
-	if (skb_cloned(skb)) {
+	if (skb_cloned(skb) || skb_has_frag_list(skb) ||
+	    skb_has_shared_frag(skb)) {
 		/* Copy the packet if shared so that we can do in-place
 		 * decryption.
 		 */
-- 
2.43.0

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[David Howells]

Hyunwoo Kim <imv4bel@gmail.com> wrote:

> The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
> handler in rxrpc_verify_response() copy the skb to a linear one before
> calling into the security ops only when skb_cloned() is true.  An skb
> that is not cloned but still carries externally-owned paged fragments
> (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
> __ip_append_data, or a chained skb_has_frag_list()) falls through to
> the in-place decryption path, which binds the frag pages directly into
> the AEAD/skcipher SGL via skb_to_sgvec().
> 
> Extend the gate to also unshare when skb_has_frag_list() or
> skb_has_shared_frag() is true.  This catches the splice-loopback vector
> and other externally-shared frag sources while preserving the
> zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
> page_pool RX, GRO).  The OOM/trace handling already in place is reused.
> 
> Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>

Acked-by: David Howells <dhowells@redhat.com>

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Jiayuan Chen]

On 5/8/26 4:53 PM, Hyunwoo Kim wrote:
> The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
> handler in rxrpc_verify_response() copy the skb to a linear one before
> calling into the security ops only when skb_cloned() is true.  An skb
> that is not cloned but still carries externally-owned paged fragments
> (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
> __ip_append_data, or a chained skb_has_frag_list()) falls through to
> the in-place decryption path, which binds the frag pages directly into
> the AEAD/skcipher SGL via skb_to_sgvec().
>
> Extend the gate to also unshare when skb_has_frag_list() or
> skb_has_shared_frag() is true.  This catches the splice-loopback vector
> and other externally-shared frag sources while preserving the
> zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
> page_pool RX, GRO).  The OOM/trace handling already in place is reused.


To be clear, frag_list is not empty for SKB_GSO_FRAGLIST and the skb 
will go through the copy path.

It's just tradeoff.

>
> Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> ---
> Changes in v3:
> - Use skb_has_frag_list() || skb_has_shared_frag() instead of skb_is_nonlinear()
> - v2: https://lore.kernel.org/all/af2F1FU5d4Q_Gn1W@v4bel/


Others lgtm, it makes sense to keep this as the ESP fix, since both 
patches address your Dirty Frag vulnerability.

Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Jeffrey E Altman]

On 5/8/2026 4:53 AM, Hyunwoo Kim wrote:
> The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
> handler in rxrpc_verify_response() copy the skb to a linear one before
> calling into the security ops only when skb_cloned() is true.  An skb
> that is not cloned but still carries externally-owned paged fragments
> (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
> __ip_append_data, or a chained skb_has_frag_list()) falls through to
> the in-place decryption path, which binds the frag pages directly into
> the AEAD/skcipher SGL via skb_to_sgvec().
>
> Extend the gate to also unshare when skb_has_frag_list() or
> skb_has_shared_frag() is true.  This catches the splice-loopback vector
> and other externally-shared frag sources while preserving the
> zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
> page_pool RX, GRO).  The OOM/trace handling already in place is reused.
>
> Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> ---
> Changes in v3:
> - Use skb_has_frag_list() || skb_has_shared_frag() instead of skb_is_nonlinear()
> - v2: https://lore.kernel.org/all/af2F1FU5d4Q_Gn1W@v4bel/
> Changes in v2:
> - Use skb_is_nonlinear() instead of skb->data_len
> - v1: https://lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel/
> ---
>   net/rxrpc/call_event.c | 4 +++-
>   net/rxrpc/conn_event.c | 3 ++-
>   2 files changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
> index fdd683261226..2b19b252225e 100644
> --- a/net/rxrpc/call_event.c
> +++ b/net/rxrpc/call_event.c
> @@ -334,7 +334,9 @@ bool rxrpc_input_call_event(struct rxrpc_call *call)
>   
>   			if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
>   			    sp->hdr.securityIndex != 0 &&
> -			    skb_cloned(skb)) {
> +			    (skb_cloned(skb) ||
> +			     skb_has_frag_list(skb) ||
> +			     skb_has_shared_frag(skb))) {
>   				/* Unshare the packet so that it can be
>   				 * modified by in-place decryption.
>   				 */

As pointed out by Jiayuan Chen, "frag_list is not empty for 
SKB_GSO_FRAGLIST and the skb
will go through the copy path."   The copy path calls skb_copy() which 
returns NULL when
SKB_GSO_FRAGLIST is set:

     if (WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST))
         return NULL;

which will cause rxrpc_input_call_event() to drop the packet:

      /* OOM - Drop the packet. */
      rxrpc_see_skb(skb, rxrpc_skb_see_unshare_nomem);

Is it safe to permit an skb with SKB_GSO_FRAGLIST set to go through the 
non-copy path
or does there needs to be some alternative logic to process the packet.

> diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
> index a2130d25aaa9..442414d90ba1 100644
> --- a/net/rxrpc/conn_event.c
> +++ b/net/rxrpc/conn_event.c
> @@ -245,7 +245,8 @@ static int rxrpc_verify_response(struct rxrpc_connection *conn,
>   {
>   	int ret;
>   
> -	if (skb_cloned(skb)) {
> +	if (skb_cloned(skb) || skb_has_frag_list(skb) ||
> +	    skb_has_shared_frag(skb)) {
>   		/* Copy the packet if shared so that we can do in-place
>   		 * decryption.
>   		 */

The copy path in rxrpc_verify_response() also calls sk_copy().

Thank you.

Jeffrey Altman

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Jakub Kicinski]

On Fri, 8 May 2026 17:53:09 +0900 Hyunwoo Kim wrote:
>  			    sp->hdr.securityIndex != 0 &&
> -			    skb_cloned(skb)) {
> +			    (skb_cloned(skb) ||
> +			     skb_has_frag_list(skb) ||
> +			     skb_has_shared_frag(skb))) {

We seem to be getting a lot of fixes for this issue, and this one is
incorrect :| Writing to _any_ frags is incorrect. You have to copy
if skb is not linear. skb_ensure_writable()

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Hyunwoo Kim]

On Sun, May 10, 2026 at 08:45:20AM -0700, Jakub Kicinski wrote:
> On Fri, 8 May 2026 17:53:09 +0900 Hyunwoo Kim wrote:
> >  			    sp->hdr.securityIndex != 0 &&
> > -			    skb_cloned(skb)) {
> > +			    (skb_cloned(skb) ||
> > +			     skb_has_frag_list(skb) ||
> > +			     skb_has_shared_frag(skb))) {
> 
> We seem to be getting a lot of fixes for this issue, and this one is
> incorrect :| Writing to _any_ frags is incorrect. You have to copy
> if skb is not linear. skb_ensure_writable()

I was testing a patch based on skb_ensure_writable() but it seems v3
has just been merged to mainline...

What would be the best way to proceed?


Best regards,
Hyunwoo Kim

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Jakub Kicinski]

On Mon, 11 May 2026 01:48:39 +0900 Hyunwoo Kim wrote:
> On Sun, May 10, 2026 at 08:45:20AM -0700, Jakub Kicinski wrote:
> > On Fri, 8 May 2026 17:53:09 +0900 Hyunwoo Kim wrote:  
> > >  			    sp->hdr.securityIndex != 0 &&
> > > -			    skb_cloned(skb)) {
> > > +			    (skb_cloned(skb) ||
> > > +			     skb_has_frag_list(skb) ||
> > > +			     skb_has_shared_frag(skb))) {  
> > 
> > We seem to be getting a lot of fixes for this issue, and this one is
> > incorrect :| Writing to _any_ frags is incorrect. You have to copy
> > if skb is not linear. skb_ensure_writable()  
> 
> I was testing a patch based on skb_ensure_writable() but it seems v3
> has just been merged to mainline...
> 
> What would be the best way to proceed?

Depends on the tree. Where was it merged?

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Fernando Fernandez Mancera]

On 5/10/26 7:03 PM, Jakub Kicinski wrote:
> On Mon, 11 May 2026 01:48:39 +0900 Hyunwoo Kim wrote:
>> On Sun, May 10, 2026 at 08:45:20AM -0700, Jakub Kicinski wrote:
>>> On Fri, 8 May 2026 17:53:09 +0900 Hyunwoo Kim wrote:
>>>>   			    sp->hdr.securityIndex != 0 &&
>>>> -			    skb_cloned(skb)) {
>>>> +			    (skb_cloned(skb) ||
>>>> +			     skb_has_frag_list(skb) ||
>>>> +			     skb_has_shared_frag(skb))) {
>>>
>>> We seem to be getting a lot of fixes for this issue, and this one is
>>> incorrect :| Writing to _any_ frags is incorrect. You have to copy
>>> if skb is not linear. skb_ensure_writable()
>>
>> I was testing a patch based on skb_ensure_writable() but it seems v3
>> has just been merged to mainline...
>>
>> What would be the best way to proceed?
> 
> Depends on the tree. Where was it merged?
> 

It is already on linus' tree.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Hyunwoo Kim]

On Sun, May 10, 2026 at 10:03:10AM -0700, Jakub Kicinski wrote:
> On Mon, 11 May 2026 01:48:39 +0900 Hyunwoo Kim wrote:
> > On Sun, May 10, 2026 at 08:45:20AM -0700, Jakub Kicinski wrote:
> > > On Fri, 8 May 2026 17:53:09 +0900 Hyunwoo Kim wrote:  
> > > >  			    sp->hdr.securityIndex != 0 &&
> > > > -			    skb_cloned(skb)) {
> > > > +			    (skb_cloned(skb) ||
> > > > +			     skb_has_frag_list(skb) ||
> > > > +			     skb_has_shared_frag(skb))) {  
> > > 
> > > We seem to be getting a lot of fixes for this issue, and this one is
> > > incorrect :| Writing to _any_ frags is incorrect. You have to copy
> > > if skb is not linear. skb_ensure_writable()  
> > 
> > I was testing a patch based on skb_ensure_writable() but it seems v3
> > has just been merged to mainline...
> > 
> > What would be the best way to proceed?
> 
> Depends on the tree. Where was it merged?

That's the torvalds tree:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Jakub Kicinski]

On Mon, 11 May 2026 02:05:19 +0900 Hyunwoo Kim wrote:
> On Sun, May 10, 2026 at 10:03:10AM -0700, Jakub Kicinski wrote:
> > On Mon, 11 May 2026 01:48:39 +0900 Hyunwoo Kim wrote:  
> > > On Sun, May 10, 2026 at 08:45:20AM -0700, Jakub Kicinski wrote:  
> > > I was testing a patch based on skb_ensure_writable() but it seems v3
> > > has just been merged to mainline...
> > > 
> > > What would be the best way to proceed?  
> > 
> > Depends on the tree. Where was it merged?  
> 
> That's the torvalds tree:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71

Send an incremental patch on top of that, pls

Re: [PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Jiayuan Chen]

On 5/10/26 11:45 PM, Jakub Kicinski wrote:
> On Fri, 8 May 2026 17:53:09 +0900 Hyunwoo Kim wrote:
>>   			    sp->hdr.securityIndex != 0 &&
>> -			    skb_cloned(skb)) {
>> +			    (skb_cloned(skb) ||
>> +			     skb_has_frag_list(skb) ||
>> +			     skb_has_shared_frag(skb))) {
> We seem to be getting a lot of fixes for this issue, and this one is
> incorrect :| Writing to _any_ frags is incorrect. You have to copy
> if skb is not linear. skb_ensure_writable()


There is a issue Simon pointed [1] that triggered 
BUG_ON(skb_shared(skb)) which was fixed by commit d0d5c0cd1e71
skb_cow_data -> __pskb_pull_tail -> pskb_expand_head -> 
BUG_ON(skb_shared(skb))

I think skb_ensure_writable will also trigger such code:
skb_ensure_writable -> pskb_may_pull -> __pskb_pull_tail -> 
pskb_expand_head -> BUG_ON(skb_shared(skb))

LPE will become panic.

[1]: 
https://lore.kernel.org/netdev/20260501155806.222592-3-horms@kernel.org/