Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2235132/?format=api
{ "id": 2235132, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2235132/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/f2f3e66fccdfbf820ed98ecd2b1c3b8c567e0b45.1778254077.git.massimiliano.pellizzer@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/1.2/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<f2f3e66fccdfbf820ed98ecd2b1c3b8c567e0b45.1778254077.git.massimiliano.pellizzer@canonical.com>", "list_archive_url": null, "date": "2026-05-08T15:42:49", "name": "[SRU,Q,1/1] xfrm: esp: avoid in-place decrypt on shared skb frags", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "079e62641525bdf9c0b79f7038e9316f3dbc769b", "submitter": { "id": 89057, "url": "http://patchwork.ozlabs.org/api/1.2/people/89057/?format=api", "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/f2f3e66fccdfbf820ed98ecd2b1c3b8c567e0b45.1778254077.git.massimiliano.pellizzer@canonical.com/mbox/", "series": [ { "id": 503412, "url": "http://patchwork.ozlabs.org/api/1.2/series/503412/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=503412", "date": "2026-05-08T15:42:49", "name": "CVE-2026-43284", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/503412/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2235132/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2235132/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=KSYqRixH;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4gBtgq5qccz1yMB\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 09 May 2026 01:43:35 +1000 (AEST)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1wLNMP-0001Gf-DG; Fri, 08 May 2026 15:43:29 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <massimiliano.pellizzer@canonical.com>)\n id 1wLNMN-0001Fp-PR\n for kernel-team@lists.ubuntu.com; Fri, 08 May 2026 15:43:27 +0000", "from mail-wm1-f72.google.com (mail-wm1-f72.google.com\n [209.85.128.72])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 92C083F869\n for <kernel-team@lists.ubuntu.com>; Fri, 8 May 2026 15:43:27 +0000 (UTC)", "by mail-wm1-f72.google.com with SMTP id\n 5b1f17b1804b1-48a5952c635so22115205e9.2\n for <kernel-team@lists.ubuntu.com>; Fri, 08 May 2026 08:43:27 -0700 (PDT)", "from tuxedo-infinitybook (net-93-66-99-204.cust.vodafonedsl.it.\n [93.66.99.204]) by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-48e6dd3b7casm3540985e9.12.2026.05.08.08.43.25\n for <kernel-team@lists.ubuntu.com>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 08 May 2026 08:43:25 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1778255007;\n bh=TeTrsSRo7xOI8coXJr0bIDvG3xdCwd7OFqwit5LQTNE=;\n h=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=KSYqRixH0nhetzyS4c/6F1KVvAAgE0nSLCEH9c32JdbxiX2g3QWZh5ufyv39r35w9\n T5Cp9mKQSibbYkMK7/yQB9DULpxDtvHcw3klV/EVJ3pP43CPA+q6/DLr+Loj6e7mg2\n umpQUfGCPVEFEb+jV4q+jspLCzHgBA1QgGmlRjO4S+fR8j5MwqPWLsKWsYOKfYkjJQ\n 2CEwL1Qfw834yQGrFFwiWxrw34juPOiLHh7GqvSuv/IlQzcTrZLKapRjqWDcG4FVQI\n GBiKFqBFUGYcVceE/SF/eE0HurOlhmb12GE3gy/O6d1ay9sZtE3nlhp5qpZHoh0tfu\n jE/Ntrc4xQzRQMg0DB0IvUI+yf3YIkSQ39Ch7RJ1F9OVRWlr4zWO0TaBWKycpdFOpS\n y8xRqbCuXqrRqtZCvItD3ZeNhPCo6gPmkt+iE5/w4LPJnDZRxf5jXnM56qCAkwkbzj\n Tb82rfGtx/eARGm6ox3dfOp+F66fXsAevaztqMpVN5Ezz9FB2+pmhRfe8e+ACB88r4\n XEnOan42ZjVkwdDlTlF73HZdorV/+Qci2JD1gyuyLUGstJJ53gK+uxx5hyY1ZT0kQk\n aMfxOjG9GeFI1+cTGP/d5433AEFE1kedvx4Y5HwmaBJ+JcepaVavho+Bmh4xV17CCt\n t8Una6AjN8Z4grzAOSqL6Rc4=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1778255007; x=1778859807;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=TeTrsSRo7xOI8coXJr0bIDvG3xdCwd7OFqwit5LQTNE=;\n b=DxnuVCwvrAzf5HmI8n0O+dllL4XEpGQtgqZaIWxROmK5JVgaDro83rp4E7sRhmvK4O\n unYLx5cs+xk4+4A++vQOWqNym0MA6SC++aKoxHvuKwM0pnMtl/7yz70CYXOM6zGiSiSU\n JIcdbDCcN48I3s8C2ylhGumsfQQiW6v/4Y3C7kbwCd3viHaOfolisWIleDfZVql6a2uG\n xeY7DctV/i+7MszyMiINdgFMUODwn46rE6SoTCA0xyXt3siLfv9JIymZLxJo47KbLdG3\n phwGQ9aqmyrb11HRQ8mORVRiti4iJ2dc7LoM629hMP5qt6VoS3P3KBFvnfQwsg+GMM8O\n 1qvQ==", "X-Gm-Message-State": "AOJu0YzJuWmCI5ICL4cVGnjso6lSrLY3wbZlXQAlbg4IBemV4Oi0LbDz\n aB/hgEOzP699WtmJ0FJYUwyCnMTaYdOWSAkdecpW184WoBKRHDGaGkx4OCbq9fkE8/BxK/6cpn5\n 1KZxoYQ9Vc4HeEQwVP7vN7byBc4HucUFCw5uMX2C/HD5MkqGV4OhHebr36VZ7t86dMuxSPTbPst\n B8DaKjLehL64VHcw==", "X-Gm-Gg": "AeBDieu+YCpNi43p4zpRkMlFmUNllpvBa/KY8Sx/eySFBvUgUdaFmWLbLNpRAgJxFff\n Io9LlhNBEXVJ3Q0lMF/w0v9k0/jq2eYKAmqaN7AAUVi1CSrq4ZVMlxm/67G/vsA0yF1iI0oWTSe\n wT53cIYDAGfl16tpdixHYPzLIPfLqfjqMttprF77KAcOl2dshfZ6ccT4kwm6Psbi877R3X+QQV6\n vH82zWAx1j226g+scYRw502NPrJS8nEPEBHUFCKPgNIdHxfXGr8V3OrKnyLiaPu0hCLZDUjNmZc\n D3vvZwt3OqSF3iTmhrK2PkLGsh4/FqiqAvkWfAhRbcL5av8JOVxoU+BD1u0+kCwiHmvlG4+fcKZ\n eoIEz04I0vDWYXm2o2cBwAMrP7fj5T6M2+dR4QMgA0U8sJ8K8LfNGlAeFFFF05ecVGrpEdKpT2V\n PtdUSYAcYJbp8nzlX2gBg04gtO6uGVAXgpfDA9UaVYgixelLILoO0VB+I85E22OpgTSeHKffivQ\n JPrzg==", "X-Received": [ "by 2002:a05:600c:a110:b0:48a:5574:3a5d with SMTP id\n 5b1f17b1804b1-48e51e195dcmr164164245e9.7.1778255006879;\n Fri, 08 May 2026 08:43:26 -0700 (PDT)", "by 2002:a05:600c:a110:b0:48a:5574:3a5d with SMTP id\n 5b1f17b1804b1-48e51e195dcmr164163685e9.7.1778255006254;\n Fri, 08 May 2026 08:43:26 -0700 (PDT)" ], "From": "Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][Q][PATCH 1/1] xfrm: esp: avoid in-place decrypt on shared skb\n frags", "Date": "Fri, 8 May 2026 17:42:49 +0200", "Message-ID": "\n <f2f3e66fccdfbf820ed98ecd2b1c3b8c567e0b45.1778254077.git.massimiliano.pellizzer@canonical.com>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<cover.1778254077.git.massimiliano.pellizzer@canonical.com>", "References": "\n <177825404593.556137.16021374556820212124@tuxedo-infinitybook.public>\n <cover.1778254077.git.massimiliano.pellizzer@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Kuan-Ting Chen <h3xrabbit@gmail.com>\n\nMSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP\nmarks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),\nso later paths that may modify packet data can first make a private\ncopy. The IPv4/IPv6 datagram append paths did not set this flag when\nsplicing pages into UDP skbs.\n\nThat leaves an ESP-in-UDP packet made from shared pipe pages looking\nlike an ordinary uncloned nonlinear skb. ESP input then takes the no-COW\nfast path for uncloned skbs without a frag_list and decrypts in place\nover data that is not owned privately by the skb.\n\nMark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching\nTCP. Also make ESP input fall back to skb_cow_data() when the flag is\npresent, so ESP does not decrypt externally backed frags in place.\nPrivate nonlinear skb frags still use the existing fast path.\n\nThis intentionally does not change ESP output. In esp_output_head(),\nthe path that appends the ESP trailer to existing skb tailroom without\ncalling skb_cow_data() is not reachable for nonlinear skbs:\nskb_tailroom() returns zero when skb->data_len is nonzero, while ESP\ntailen is positive. Thus ESP output will either use the separate\ndestination-frag path or fall back to skb_cow_data().\n\nFixes: cac2661c53f3 (\"esp4: Avoid skb_cow_data whenever possible\")\nFixes: 03e2a30f6a27 (\"esp6: Avoid skb_cow_data whenever possible\")\nFixes: 7da0dde68486 (\"ip, udp: Support MSG_SPLICE_PAGES\")\nFixes: 6d8192bd69bb (\"ip6, udp6: Support MSG_SPLICE_PAGES\")\nReported-by: Hyunwoo Kim <imv4bel@gmail.com>\nReported-by: Kuan-Ting Chen <h3xrabbit@gmail.com>\nTested-by: Hyunwoo Kim <imv4bel@gmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\n(cherry picked from commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4)\nCVE-2026-43284\nSigned-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>\n---\n net/ipv4/esp4.c | 3 ++-\n net/ipv4/ip_output.c | 2 ++\n net/ipv6/esp6.c | 3 ++-\n net/ipv6/ip6_output.c | 2 ++\n 4 files changed, 8 insertions(+), 2 deletions(-)", "diff": "diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c\nindex f14a41ee4aa1..e74583c91603 100644\n--- a/net/ipv4/esp4.c\n+++ b/net/ipv4/esp4.c\n@@ -870,7 +870,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)\n \t\t\tnfrags = 1;\n \n \t\t\tgoto skip_cow;\n-\t\t} else if (!skb_has_frag_list(skb)) {\n+\t\t} else if (!skb_has_frag_list(skb) &&\n+\t\t\t !skb_has_shared_frag(skb)) {\n \t\t\tnfrags = skb_shinfo(skb)->nr_frags;\n \t\t\tnfrags++;\n \ndiff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c\nindex 84e7f8a2f50f..7b489516bb83 100644\n--- a/net/ipv4/ip_output.c\n+++ b/net/ipv4/ip_output.c\n@@ -1231,6 +1231,8 @@ static int __ip_append_data(struct sock *sk,\n \t\t\tif (err < 0)\n \t\t\t\tgoto error;\n \t\t\tcopy = err;\n+\t\t\tif (!(flags & MSG_NO_SHARED_FRAGS))\n+\t\t\t\tskb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;\n \t\t\twmem_alloc_delta += copy;\n \t\t} else if (!zc) {\n \t\t\tint i = skb_shinfo(skb)->nr_frags;\ndiff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c\nindex 72adfc107b55..6d554db1274c 100644\n--- a/net/ipv6/esp6.c\n+++ b/net/ipv6/esp6.c\n@@ -912,7 +912,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)\n \t\t\tnfrags = 1;\n \n \t\t\tgoto skip_cow;\n-\t\t} else if (!skb_has_frag_list(skb)) {\n+\t\t} else if (!skb_has_frag_list(skb) &&\n+\t\t\t !skb_has_shared_frag(skb)) {\n \t\t\tnfrags = skb_shinfo(skb)->nr_frags;\n \t\t\tnfrags++;\n \ndiff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c\nindex 9d64c13bab5e..50974fb4e55b 100644\n--- a/net/ipv6/ip6_output.c\n+++ b/net/ipv6/ip6_output.c\n@@ -1775,6 +1775,8 @@ static int __ip6_append_data(struct sock *sk,\n \t\t\tif (err < 0)\n \t\t\t\tgoto error;\n \t\t\tcopy = err;\n+\t\t\tif (!(flags & MSG_NO_SHARED_FRAGS))\n+\t\t\t\tskb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;\n \t\t\twmem_alloc_delta += copy;\n \t\t} else if (!zc) {\n \t\t\tint i = skb_shinfo(skb)->nr_frags;\n", "prefixes": [ "SRU", "Q", "1/1" ] }