Re: [PATCH net v2] net: skbuff: propagate shared-frag marker through frag-transfer helpers

[Sabrina Dubroca <sd@queasysnail.net>]

2026-05-14, 08:37:19 -0600, David Ahern wrote:
> On 5/14/26 4:21 AM, Sabrina Dubroca wrote:
> > 2026-05-14, 18:38:34 +0900, Hyunwoo Kim wrote:
> >> On Thu, May 14, 2026 at 10:04:29AM +0200, Paolo Abeni wrote:
> >>> On 5/13/26 11:07 PM, Hyunwoo Kim wrote:
> 
> >> Agreed. tracing SKBFL_SHARED_FRAG propagation paths one by one is
> >> not a robust direction for the fix. Even minor logic changes elsewhere
> >> could cause the issue to resurface.
> >>
> >> As a follow-up,	eliminating the in-place handling in esp_input -- accepting 
> > 
> > It would close this group of vulnerabilities, but there are other
> > parts of the networking stack that consume this flag. For those,
> > chasing missing flag propagation is still a useful task.
> > 
> 
> Seems like this should be an skb helper to manage the flag with really
> good documentation on when it needs to be set, reset and propagated.
> 
> I walked skbuff.c yesterday as well, and there are several places where
> it is not clear if the flag needs to be propagated or not.

Or maybe even something like a skb_transfer_frag that handles updating
the frags array and copying the flag. Then we wouldn't have to chase
functions that mess with frags[] directly and forget to also adjust
flags.

-- 
Sabrina