Re: [PATCH ipsec] esp: Force skb_cow_data() on RX when the skb is non-linear

[Herbert Xu <herbert@gondor.apana.org.au>]

On Thu, Apr 30, 2026 at 11:49:13AM +0900, Hyunwoo Kim wrote:
> esp_input() and esp6_input() skip skb_cow_data() on uncloned skbs
> through two arms: one for fully linear skbs (nfrags = 1) and one for
> skbs carrying paged fragments without a frag_list, which sets
> nfrags = skb_shinfo(skb)->nr_frags + 1.  In both arms the skb is mapped
> into a scatterlist via skb_to_sgvec() and passed as both src and dst of
> aead_request_set_crypt(), so the AEAD operates in place over the
> existing frag pages.
> 
> Drop the paged-fragment arm so any non-linear inbound skb falls through
> to skb_cow_data().  The fully linear fast path is unchanged and the
> existing skb_cow_data() error handling that follows the gate is reused.
> 
> Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
> Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
> Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> ---
>  net/ipv4/esp4.c | 13 +++----------
>  net/ipv6/esp6.c | 13 +++----------
>  2 files changed, 6 insertions(+), 20 deletions(-)

Good catch!

When a packet comes from a device driver, it's usually safe to
write to the fragments since they would have been allocated by
the driver.

But when a packet originates from our own stack, then it's not
safe to write to the fragments.

Unfortunately the two paths cross with the loopback driver (and
probably other means of creating loopback).

Acked-by: Herbert Xu <herbert@gondor.apana.org.au>

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt