[PATCH net] xfrm: esp: restore combined single-frag length gate

[PATCH net] xfrm: esp: restore combined single-frag length gate

[tanjingguo]

From 1e6d45378b272fe2f1fce48ed89d6eaa415c00c2 Mon Sep 17 00:00:00 2001
From: Jingguo Tan <tanjingguo@huawei.com>
Date: Mon, 18 May 2026 17:06:48 +0800
Subject: [PATCH net] xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path still consumes the combined post-trailer
skb->data_len as a single destination frag in esp_output_tail()/
esp6_output_tail(). The head-side gate must therefore reject any case
where ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) exceeds PAGE_SIZE,
otherwise skb_page_frag_refill() may fall back to a single page and the
destination sg will overrun it.

Restore a combined-length page gate before entering the page-frag fast
path for both IPv4 and IPv6.

Fixes: 5bd8baab087d ("esp: limit skb_page_frag_refill use to a single page")
Cc: stable@vger.kernel.org
Signed-off-by: Lin Ma <malin89@huawei.com>
Signed-off-by: Chenyuan Mi <michenyuan@huawei.com>
Signed-off-by: Jingguo Tan <tanjingguo@huawei.com>
---

 net/ipv4/esp4.c | 5 +++--
 net/ipv6/esp6.c | 5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 6a5febbdbee49..2d7daca8516c2 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -410,6 +410,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
 	struct page *page;
 	struct sk_buff *trailer;
 	int tailen = esp->tailen;
+	unsigned int allocsize;
 
 	/* this is non-NULL only with TCP/UDP Encapsulation */
 	if (x->encap) {
@@ -419,8 +420,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
 			return err;
 	}
 
-	if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
-	    ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+	allocsize = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+	if (allocsize > PAGE_SIZE)
 		goto cow;
 
 	if (!skb_cloned(skb)) {
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 9c06c5a1419dc..0fad1dc558b84 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -440,6 +440,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
 	struct page *page;
 	struct sk_buff *trailer;
 	int tailen = esp->tailen;
+	unsigned int allocsize;
 
 	if (x->encap) {
 		int err = esp6_output_encap(x, skb, esp);
@@ -448,8 +449,8 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
 			return err;
 	}
 
-	if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
-	    ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+	allocsize = ALIGN(skb->data_len + tailen, L1_CACHE_BYTES);
+	if (allocsize > PAGE_SIZE)
 		goto cow;
 
 	if (!skb_cloned(skb)) {
-- 
2.43.0

Re: [PATCH net] xfrm: esp: restore combined single-frag length gate

[Sabrina Dubroca]

Hello,

note: patches to xfrm should go through the "ipsec" tree, not "net"
(with the subject prefix [PATCH ipsec]).

2026-05-21, 07:52:50 +0000, tanjingguo wrote:
> From 1e6d45378b272fe2f1fce48ed89d6eaa415c00c2 Mon Sep 17 00:00:00 2001
> From: Jingguo Tan <tanjingguo@huawei.com>
> Date: Mon, 18 May 2026 17:06:48 +0800
> Subject: [PATCH net] xfrm: esp: restore combined single-frag length gate
> 
> The ESP out-of-place fast path still consumes the combined post-trailer
> skb->data_len as a single destination frag in esp_output_tail()/
> esp6_output_tail(). The head-side gate must therefore reject any case
> where ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) exceeds PAGE_SIZE,
> otherwise skb_page_frag_refill() may fall back to a single page and the
> destination sg will overrun it.

If I'm following correctly, the issue comes from the
skb_len_add(tailen)? So esp_output_tail() does skb_page_frag_refill()
with [what we checked in esp_output_head() + tailen]?

> Restore a combined-length page gate before entering the page-frag fast
> path for both IPv4 and IPv6.
> 
> Fixes: 5bd8baab087d ("esp: limit skb_page_frag_refill use to a single page")
> Cc: stable@vger.kernel.org
> Signed-off-by: Lin Ma <malin89@huawei.com>
> Signed-off-by: Chenyuan Mi <michenyuan@huawei.com>
> Signed-off-by: Jingguo Tan <tanjingguo@huawei.com>
> ---
> 
>  net/ipv4/esp4.c | 5 +++--
>  net/ipv6/esp6.c | 5 +++--
>  2 files changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
> index 6a5febbdbee49..2d7daca8516c2 100644
> --- a/net/ipv4/esp4.c
> +++ b/net/ipv4/esp4.c
> @@ -410,6 +410,7 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
>  	struct page *page;
>  	struct sk_buff *trailer;
>  	int tailen = esp->tailen;
> +	unsigned int allocsize;

nit: there's already an allocsize variable in this function. no
shadowing please.

-- 
Sabrina

Re: [PATCH net] xfrm: esp: restore combined single-frag length gate

[tanjingguo]

Hi, Sabrina.


Thanks for the review.

I have sent the v2 patch with below link:
https://lore.kernel.org/netdev/ab4c5808478d48978292c318d85c4484@huawei.com/T/#u

> note: patches to xfrm should go through the "ipsec" tree, not "net"
> (with the subject prefix [PATCH ipsec]).

Thanks also for pointing out that, I have sent v2 with correct prefix.

> If I'm following correctly, the issue comes from the
> skb_len_add(tailen)? So esp_output_tail() does skb_page_frag_refill()
> with [what we checked in esp_output_head() + tailen]?

Yes, your understanding is correct. esp_output_head() appends tailen to
the skb before esp_output_tail() reaches the out-of-place allocation path.
In IPv4 this happens through skb_len_add(skb, tailen), and in IPv6 through
the explicit skb->len / skb->data_len / skb->truesize updates. After that,
esp_output_tail() computes:

  allocsize = ALIGN(skb->data_len, L1_CACHE_BYTES);

and uses that size for skb_page_frag_refill(). So the page-frag fast path
needs to validate the combined post-trailer data length, not skb->data_len
and tailen independently.

> nit: there's already an allocsize variable in this function. no
> shadowing please.

You are right. The new allocsize variable in v1 shadows the existing variable.
In v2 I wrote the combined-length check directly, avoiding the shadowed variable.

Thanks