Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2235138/?format=api
{ "id": 2235138, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2235138/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/24c73dce6498b6403495376b7a088b84cb8deb1c.1778254087.git.massimiliano.pellizzer@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/1.2/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<24c73dce6498b6403495376b7a088b84cb8deb1c.1778254087.git.massimiliano.pellizzer@canonical.com>", "list_archive_url": null, "date": "2026-05-08T15:42:51", "name": "[SRU,N,1/1] xfrm: esp: avoid in-place decrypt on shared skb frags", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "079e62641525bdf9c0b79f7038e9316f3dbc769b", "submitter": { "id": 89057, "url": "http://patchwork.ozlabs.org/api/1.2/people/89057/?format=api", "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/24c73dce6498b6403495376b7a088b84cb8deb1c.1778254087.git.massimiliano.pellizzer@canonical.com/mbox/", "series": [ { "id": 503414, "url": "http://patchwork.ozlabs.org/api/1.2/series/503414/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=503414", "date": "2026-05-08T15:42:50", "name": "CVE-2026-43284", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/503414/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2235138/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2235138/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=SUjAjcdZ;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4gBtgv0VYyz1yJq\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 09 May 2026 01:43:39 +1000 (AEST)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1wLNMS-0001NL-MS; Fri, 08 May 2026 15:43:32 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <massimiliano.pellizzer@canonical.com>)\n id 1wLNMQ-0001IS-0n\n for kernel-team@lists.ubuntu.com; Fri, 08 May 2026 15:43:30 +0000", "from mail-wm1-f69.google.com (mail-wm1-f69.google.com\n [209.85.128.69])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id E5F313F869\n for <kernel-team@lists.ubuntu.com>; Fri, 8 May 2026 15:43:29 +0000 (UTC)", "by mail-wm1-f69.google.com with SMTP id\n 5b1f17b1804b1-4891f97aef0so11433525e9.2\n for <kernel-team@lists.ubuntu.com>; Fri, 08 May 2026 08:43:29 -0700 (PDT)", "from tuxedo-infinitybook (net-93-66-99-204.cust.vodafonedsl.it.\n [93.66.99.204]) by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-48e6dd3b7casm3540985e9.12.2026.05.08.08.43.27\n for <kernel-team@lists.ubuntu.com>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 08 May 2026 08:43:28 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1778255009;\n bh=jCOzHAuc1aJkV1XY7vGZtk7wppfmtZiOnydzlwPk5hk=;\n h=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=SUjAjcdZ1Pcg6L1j4ux2nBLJYyaXMq2QFL7HbeRLFvflkpcHm4ZGAzEjqfGTpNSqJ\n ajyBMcwE8e32wKVhwqaZuW7QgCXBKEw7ywAn/4urxYlB7w62vHYVPyjad0pEdY9A7/\n 33pPwGMLp1IshOnNr4XgmiR+imS2pzDQLtNHiX0E8RhiQOCVE/2pJp4wXB4J2eB68x\n 7gm053soMM1ylBcie6n8dfk5EyzvrL1AF1cGO8u0iaSB5HbgTgf7DRAyEoHlqS76L1\n LOP40BaRj7pL9AE1NK1x1jIMwSZJF4UKnoYwrE/rENbrXl5MRZiZtetyQRZa4xlbHZ\n 8IAhWH+kfvhDSwKVEZoA2+QnZwcl8Vtkwdht0fbVCgYtFAMX+7lYAF2xykj9ELeVkm\n sYAnLXT+DRPF3NNist8me9HELlPoiGOt+wKqcyJi2mi7wWC/uwmj4/IMMUZPB685qa\n 01oF4fQNVGxH89Q8k/2EWQiNJysUVhlCSc4XOT54k1nsBtWKarAHJkcuHTYikJWqT+\n DyTaRxZeaRRBoMenDoqekLtwh8IFDuqzQrYpETbceNgq0CCWsydwqU8BGj5B2Crz2v\n b/vfSpkAiPI3WZXgPFH4igx2+oj6yGEwadvMXVP5w2um+Xv6TShXrpJxEWk2swjFfu\n eC5j0ZEfr0oXVTP+3DXPbSSo=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1778255009; x=1778859809;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=jCOzHAuc1aJkV1XY7vGZtk7wppfmtZiOnydzlwPk5hk=;\n b=Tz0MWnjUdVogD6qfhWdLn3ngxUK2PGWj/dT2eAJf30STZWurEKwNE8lziaG1aULMKG\n fxW85QlL889nufpJdzZSI13MtcjfN0r4ppST08klIP3kwGzlbzRsn3ZbjBCoWFw9K68o\n g7OExJvMoSF3c9dI2tRj8fv2lyI3/I3MK4u7OxbY4lgFeckKiaYPLQ3+akuxdFGHvNHD\n bqQNyGbXyTYliGlA6W9VTnnVtEXZxXsw8AIeZL7qW4/mbhqWVyV6ouClkNZtcR/Lt7u2\n /EsIQRbZAhPZs6ehFf8uWE9wIiLQT6LKBVVHrQNKLuUDy4/NPxRmCJolaDsLVDB3XH0L\n b53Q==", "X-Gm-Message-State": "AOJu0Yy7WHcWga2yOdP2kiMUfW6082dWvzgE+l0MUlzeN3rY68HBXRLR\n Nlb/gRxDFI+WbIbVVDSbQyHPW0U5nD2u9DILJp7zGpU625AX3GnR5gAffKqYQIJ2WBwgQ+iqOwM\n UoC5Fx+l2VQBEeNQQkCEbyH8mAOUZ+T89efd2jJK/rKke9V8DU28Ai2Sc61ljpXEIj+Lc4WNC5A\n P3MLzIDc0gAyoqEA==", "X-Gm-Gg": "AeBDiev/HRtYbAtu7XOz/LYRTPpR70mBrjebz91RWuZgdHTVqCTA9DzoyVfvSxfGDDg\n hViI3MPVyYhhvW9R2BirAHwZN+DEfFIYhfxrBbhssXDzzWONT0P53qobbcolGS1f1EAr0E5KYK9\n HkDUrYNgGdhaYywMyit5HKTGF2I56CN2EvVHM8Hv88QuywQtGTmuKTq3QSTEBV1AevFsxpOlbm1\n +GzFksPQ0PXP2budvFhJShyVkBZ0naJhxAuhkgJg6tIBevQh8Wy+Cy8QVNOyMcxFrcQCuIqmxfO\n eWZbruGEumwv00RTXEetLnT8S0NBLGq/igyjBB9eYgPxKIt8bzabGqEIWlIkjmhq6GbOXSH427u\n 8eLSAzdcpiu8c3eOP/B5/u883MMZBzxim9C7/jgYjpDkxyznE6ZyJAXsWSYVbNaFLU4TYbnV+S7\n IT0NPn5GmBw1K+ew9d2/6vPhmuqJ0eTX1l9byGgJ2BxuDNAR5+/Q4aNFKqaA0GK02JEWwXzGXW7\n itmX+28rmc3DSJM", "X-Received": [ "by 2002:a05:600d:6:b0:48a:8905:a500 with SMTP id\n 5b1f17b1804b1-48e51f1d04bmr156926535e9.12.1778255009044;\n Fri, 08 May 2026 08:43:29 -0700 (PDT)", "by 2002:a05:600d:6:b0:48a:8905:a500 with SMTP id\n 5b1f17b1804b1-48e51f1d04bmr156926225e9.12.1778255008553;\n Fri, 08 May 2026 08:43:28 -0700 (PDT)" ], "From": "Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][N][PATCH 1/1] xfrm: esp: avoid in-place decrypt on shared skb\n frags", "Date": "Fri, 8 May 2026 17:42:51 +0200", "Message-ID": "\n <24c73dce6498b6403495376b7a088b84cb8deb1c.1778254087.git.massimiliano.pellizzer@canonical.com>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<cover.1778254087.git.massimiliano.pellizzer@canonical.com>", "References": "\n <177825404593.556137.16021374556820212124@tuxedo-infinitybook.public>\n <cover.1778254087.git.massimiliano.pellizzer@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Kuan-Ting Chen <h3xrabbit@gmail.com>\n\nMSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP\nmarks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),\nso later paths that may modify packet data can first make a private\ncopy. The IPv4/IPv6 datagram append paths did not set this flag when\nsplicing pages into UDP skbs.\n\nThat leaves an ESP-in-UDP packet made from shared pipe pages looking\nlike an ordinary uncloned nonlinear skb. ESP input then takes the no-COW\nfast path for uncloned skbs without a frag_list and decrypts in place\nover data that is not owned privately by the skb.\n\nMark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching\nTCP. Also make ESP input fall back to skb_cow_data() when the flag is\npresent, so ESP does not decrypt externally backed frags in place.\nPrivate nonlinear skb frags still use the existing fast path.\n\nThis intentionally does not change ESP output. In esp_output_head(),\nthe path that appends the ESP trailer to existing skb tailroom without\ncalling skb_cow_data() is not reachable for nonlinear skbs:\nskb_tailroom() returns zero when skb->data_len is nonzero, while ESP\ntailen is positive. Thus ESP output will either use the separate\ndestination-frag path or fall back to skb_cow_data().\n\nFixes: cac2661c53f3 (\"esp4: Avoid skb_cow_data whenever possible\")\nFixes: 03e2a30f6a27 (\"esp6: Avoid skb_cow_data whenever possible\")\nFixes: 7da0dde68486 (\"ip, udp: Support MSG_SPLICE_PAGES\")\nFixes: 6d8192bd69bb (\"ip6, udp6: Support MSG_SPLICE_PAGES\")\nReported-by: Hyunwoo Kim <imv4bel@gmail.com>\nReported-by: Kuan-Ting Chen <h3xrabbit@gmail.com>\nTested-by: Hyunwoo Kim <imv4bel@gmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\n(cherry picked from commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4)\nCVE-2026-43284\nSigned-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>\n---\n net/ipv4/esp4.c | 3 ++-\n net/ipv4/ip_output.c | 2 ++\n net/ipv6/esp6.c | 3 ++-\n net/ipv6/ip6_output.c | 2 ++\n 4 files changed, 8 insertions(+), 2 deletions(-)", "diff": "diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c\nindex 2d2b8bd0ee74..6b1384258283 100644\n--- a/net/ipv4/esp4.c\n+++ b/net/ipv4/esp4.c\n@@ -870,7 +870,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)\n \t\t\tnfrags = 1;\n \n \t\t\tgoto skip_cow;\n-\t\t} else if (!skb_has_frag_list(skb)) {\n+\t\t} else if (!skb_has_frag_list(skb) &&\n+\t\t\t !skb_has_shared_frag(skb)) {\n \t\t\tnfrags = skb_shinfo(skb)->nr_frags;\n \t\t\tnfrags++;\n \ndiff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c\nindex 8568325bf5d5..808e9a558f78 100644\n--- a/net/ipv4/ip_output.c\n+++ b/net/ipv4/ip_output.c\n@@ -1230,6 +1230,8 @@ static int __ip_append_data(struct sock *sk,\n \t\t\tif (err < 0)\n \t\t\t\tgoto error;\n \t\t\tcopy = err;\n+\t\t\tif (!(flags & MSG_NO_SHARED_FRAGS))\n+\t\t\t\tskb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;\n \t\t\twmem_alloc_delta += copy;\n \t\t} else if (!zc) {\n \t\t\tint i = skb_shinfo(skb)->nr_frags;\ndiff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c\nindex 09944cad384a..d4e3bc585d7b 100644\n--- a/net/ipv6/esp6.c\n+++ b/net/ipv6/esp6.c\n@@ -918,7 +918,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)\n \t\t\tnfrags = 1;\n \n \t\t\tgoto skip_cow;\n-\t\t} else if (!skb_has_frag_list(skb)) {\n+\t\t} else if (!skb_has_frag_list(skb) &&\n+\t\t\t !skb_has_shared_frag(skb)) {\n \t\t\tnfrags = skb_shinfo(skb)->nr_frags;\n \t\t\tnfrags++;\n \ndiff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c\nindex b224c77e011d..4c11b96ccbe4 100644\n--- a/net/ipv6/ip6_output.c\n+++ b/net/ipv6/ip6_output.c\n@@ -1755,6 +1755,8 @@ static int __ip6_append_data(struct sock *sk,\n \t\t\tif (err < 0)\n \t\t\t\tgoto error;\n \t\t\tcopy = err;\n+\t\t\tif (!(flags & MSG_NO_SHARED_FRAGS))\n+\t\t\t\tskb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;\n \t\t\twmem_alloc_delta += copy;\n \t\t} else if (!zc) {\n \t\t\tint i = skb_shinfo(skb)->nr_frags;\n", "prefixes": [ "SRU", "N", "1/1" ] }