Re: [PATCH net] xfrm: esp: restore combined single-frag length gate

[tanjingguo <tanjingguo@huawei.com>]

Hi, Sabrina.


Thanks for the review.

I have sent the v2 patch with below link:
https://lore.kernel.org/netdev/ab4c5808478d48978292c318d85c4484@huawei.com/T/#u

> note: patches to xfrm should go through the "ipsec" tree, not "net"
> (with the subject prefix [PATCH ipsec]).

Thanks also for pointing out that, I have sent v2 with correct prefix.

> If I'm following correctly, the issue comes from the
> skb_len_add(tailen)? So esp_output_tail() does skb_page_frag_refill()
> with [what we checked in esp_output_head() + tailen]?

Yes, your understanding is correct. esp_output_head() appends tailen to
the skb before esp_output_tail() reaches the out-of-place allocation path.
In IPv4 this happens through skb_len_add(skb, tailen), and in IPv6 through
the explicit skb->len / skb->data_len / skb->truesize updates. After that,
esp_output_tail() computes:

  allocsize = ALIGN(skb->data_len, L1_CACHE_BYTES);

and uses that size for skb_page_frag_refill(). So the page-frag fast path
needs to validate the combined post-trailer data length, not skb->data_len
and tailen independently.

> nit: there's already an allocsize variable in this function. no
> shadowing please.

You are right. The new allocsize variable in v1 shadows the existing variable.
In v2 I wrote the combined-length check directly, avoiding the shadowed variable.

Thanks