[PATCH 0/6] pull request (net): ipsec 2026-06-10

[Steffen Klassert <steffen.klassert@secunet.com>]

1) xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()                                                                       
   Propagate SKBFL_SHARED_FRAG when paged fragments are moved between                                                                      
   skbs so ESP can decide whether in-place crypto is safe.                                                                                 
 
2) xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload                                                                 
   Replace the unlocked read of xtfs->ra_newskb with a local flag so a                                                                     
   concurrent reassembly can no longer free first_skb between                                                                              
   spin_unlock and the post-loop check.                                                                                                    
 
3) xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()                                                              
   Prune the inexact bin under xfrm_policy_lock so a concurrent                                                                            
   xfrm_hash_rebuild() can no longer free it before xfrm_policy_kill()                                                                     
   dereferences it.                                                                                                                        
 
4) xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()                                                                                 
   Move hrtimer_cancel() for the output and drop timers ahead of their                                                                     
   spinlocks, breaking the softirq/lock cycle that could deadlock                                                                          
   against the timer callbacks on SMP.                                                                                                     
 
5) xfrm: espintcp: do not reuse an in-progress partial send                                                                                
   Fail a new send when espintcp_push_msgs() returns with emsg->len                                                                        
   still set, so a blocking caller can no longer overwrite ctx->partial                                                                    
   while a previous transfer still owns it.                                                                                                
 
6) esp: fix page frag reference leak on skb_to_sgvec failure                                                                               
   Add a flag to esp_ssg_unref() to unconditionally unref the source                                                                       
   scatterlist, releasing the old page references that are otherwise                                                                       
   leaked when the second skb_to_sgvec() in esp_output_tail() fails.

Please pull or let me know if there are problems.

Thanks!

The following changes since commit 78ef59e7a6459b16f8102e0ee1c718443323d1af:

  Merge branch 'wireguard-fixes-for-7-1-rc6' (2026-05-29 13:01:31 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec.git tags/ipsec-2026-06-10

for you to fetch changes up to 26aad08a928901296aabfbc7a33ecb951656bb98:

  esp: fix page frag reference leak on skb_to_sgvec failure (2026-06-09 15:58:17 +0200)

----------------------------------------------------------------
ipsec-2026-06-10

----------------------------------------------------------------
Alessandro Schino (1):
      esp: fix page frag reference leak on skb_to_sgvec failure

Sanghyun Park (1):
      xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Takao Sato (1):
      xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()

Tristan Madani (1):
      xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()

Wyatt Feng (1):
      xfrm: espintcp: do not reuse an in-progress partial send

Zhenghang Xiao (1):
      xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload

 net/ipv4/esp4.c        | 17 +++++++++++------
 net/ipv6/esp6.c        | 17 +++++++++++------
 net/xfrm/espintcp.c    |  4 ++++
 net/xfrm/xfrm_iptfs.c  | 11 +++++++----
 net/xfrm/xfrm_policy.c | 13 ++-----------
 5 files changed, 35 insertions(+), 27 deletions(-)