Re: [PATCH ipsec] esp: Force skb_cow_data() on RX when the skb is non-linear

[Hyunwoo Kim <imv4bel@gmail.com>]

On Thu, Apr 30, 2026 at 12:26:16PM +0800, Herbert Xu wrote:
> On Thu, Apr 30, 2026 at 11:49:13AM +0900, Hyunwoo Kim wrote:
> > esp_input() and esp6_input() skip skb_cow_data() on uncloned skbs
> > through two arms: one for fully linear skbs (nfrags = 1) and one for
> > skbs carrying paged fragments without a frag_list, which sets
> > nfrags = skb_shinfo(skb)->nr_frags + 1.  In both arms the skb is mapped
> > into a scatterlist via skb_to_sgvec() and passed as both src and dst of
> > aead_request_set_crypt(), so the AEAD operates in place over the
> > existing frag pages.
> > 
> > Drop the paged-fragment arm so any non-linear inbound skb falls through
> > to skb_cow_data().  The fully linear fast path is unchanged and the
> > existing skb_cow_data() error handling that follows the gate is reused.
> > 
> > Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
> > Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
> > Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
> > ---
> >  net/ipv4/esp4.c | 13 +++----------
> >  net/ipv6/esp6.c | 13 +++----------
> >  2 files changed, 6 insertions(+), 20 deletions(-)
> 
> Good catch!
> 
> When a packet comes from a device driver, it's usually safe to
> write to the fragments since they would have been allocated by
> the driver.
> 
> But when a packet originates from our own stack, then it's not
> safe to write to the fragments.
> 
> Unfortunately the two paths cross with the loopback driver (and
> probably other means of creating loopback).
> 
> Acked-by: Herbert Xu <herbert@gondor.apana.org.au>

Thank you for the review.

If it's not too much trouble, I would be grateful if you could also 
take a look at this rxrpc patch, which addresses a similar bug: 
https://lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel/


Best regards,
Hyunwoo Kim

> 
> Thanks,
> -- 
> Email: Herbert Xu <herbert@gondor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt