Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2235141/?format=api
{ "id": 2235141, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2235141/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/2769a8450bc3feebf4ec4be2ca55fa076e5e444e.1778254528.git.massimiliano.pellizzer@canonical.com/", "project": { "id": 15, "url": "http://patchwork.ozlabs.org/api/1.2/projects/15/?format=api", "name": "Ubuntu Kernel", "link_name": "ubuntu-kernel", "list_id": "kernel-team.lists.ubuntu.com", "list_email": "kernel-team@lists.ubuntu.com", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<2769a8450bc3feebf4ec4be2ca55fa076e5e444e.1778254528.git.massimiliano.pellizzer@canonical.com>", "list_archive_url": null, "date": "2026-05-08T15:42:53", "name": "[SRU,J,1/2] xfrm: esp: avoid in-place decrypt on shared skb frags", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "d9ac6b97a8273ea40e46b4b31057aa82e8c69506", "submitter": { "id": 89057, "url": "http://patchwork.ozlabs.org/api/1.2/people/89057/?format=api", "name": "Massimiliano Pellizzer", "email": "massimiliano.pellizzer@canonical.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/ubuntu-kernel/patch/2769a8450bc3feebf4ec4be2ca55fa076e5e444e.1778254528.git.massimiliano.pellizzer@canonical.com/mbox/", "series": [ { "id": 503415, "url": "http://patchwork.ozlabs.org/api/1.2/series/503415/?format=api", "web_url": "http://patchwork.ozlabs.org/project/ubuntu-kernel/list/?series=503415", "date": "2026-05-08T15:42:52", "name": "CVE-2026-43284", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/503415/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2235141/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2235141/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<kernel-team-bounces@lists.ubuntu.com>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=fail reason=\"signature verification failed\" (4096-bit key;\n unprotected) header.d=canonical.com header.i=@canonical.com\n header.a=rsa-sha256 header.s=20251003 header.b=DF81sLh9;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com\n (client-ip=185.125.189.65; helo=lists.ubuntu.com;\n envelope-from=kernel-team-bounces@lists.ubuntu.com;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4gBtgx3wJHz1yJq\n\tfor <incoming@patchwork.ozlabs.org>; Sat, 09 May 2026 01:43:41 +1000 (AEST)", "from localhost ([127.0.0.1] helo=lists.ubuntu.com)\n\tby lists.ubuntu.com with esmtp (Exim 4.86_2)\n\t(envelope-from <kernel-team-bounces@lists.ubuntu.com>)\n\tid 1wLNMV-0001Sw-6A; Fri, 08 May 2026 15:43:35 +0000", "from smtp-relay-internal-1.internal ([10.131.114.114]\n helo=smtp-relay-internal-1.canonical.com)\n by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)\n (Exim 4.86_2) (envelope-from <massimiliano.pellizzer@canonical.com>)\n id 1wLNMR-0001Lo-Pm\n for kernel-team@lists.ubuntu.com; Fri, 08 May 2026 15:43:31 +0000", "from mail-wr1-f72.google.com (mail-wr1-f72.google.com\n [209.85.221.72])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest\n SHA256)\n (No client certificate requested)\n by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 8998E3F869\n for <kernel-team@lists.ubuntu.com>; Fri, 8 May 2026 15:43:31 +0000 (UTC)", "by mail-wr1-f72.google.com with SMTP id\n ffacd0b85a97d-4411a36715dso1544445f8f.2\n for <kernel-team@lists.ubuntu.com>; Fri, 08 May 2026 08:43:31 -0700 (PDT)", "from tuxedo-infinitybook (net-93-66-99-204.cust.vodafonedsl.it.\n [93.66.99.204]) by smtp.gmail.com with ESMTPSA id\n 5b1f17b1804b1-48e6dd3b7casm3540985e9.12.2026.05.08.08.43.29\n for <kernel-team@lists.ubuntu.com>\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Fri, 08 May 2026 08:43:29 -0700 (PDT)" ], "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com;\n s=20251003; t=1778255011;\n bh=FYQGzs594jdHhZbeln97AvhkMwGywXvp35GsoC12Jg8=;\n h=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n MIME-Version;\n b=DF81sLh9gO+RptWFip/yQ7QYTgZX+2natpVLNWbuzyKbVfD/qxBgwxBKQXW/aKHhF\n AhuKFonnY/TVYTVC3Y/w4mn4o5DEIuqoMio+DR+BS9LZ5oukthPBx8GmpDArCH9IvF\n asqugZ54Arm66UlK0M4nTzE2lrROXt4QBcLGWMBLMWNu7y2JofEB5JN+V9TuJqwRHS\n DXU7qE2TU1vvoJp7qTQMetCc2YVLlsVkhoBiQzmNH0oNttd7ETMxZjVn3YsvQoo0AH\n EDJwCn+W3Dcvj9cUqXJwhpxM2u+ew7nVdBcaofHy7GH0I784fNviUIX1JEfIb7nbxa\n BI1SYQZ2nl78rwRtYEDHSx5yuIK2Mp8zPAa5fDfuHA7XzC0f6Fs6d9MNw4W5XUW4oo\n 3p5dHcn4pekrGeXubCIfnUm1wGpyJV4ICDMz+p9tmFN7T5xACa1ytZ9Nw3/VFfOVYh\n tlWWdScLzctblWLbLucs6/uzgVBgoeZk1DpbT8C+ykfsvcX9brO/dLJxWIiep856NG\n dobxmM7/Ag+TCGGNiJFF7XVYDe+ptIyjzX5sw7VsT0Z+WIZDfxvDXaLCiMySuQhvjw\n 2o1z5d7J9hJVBF9gYU3H6QkmN2g6J0jfMgVvqt1T2y3fgitH1Oy1nGYxRZe+I/PDt0\n 1HyS9SLeZxiILFHKoPM7yjs8=", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1778255011; x=1778859811;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to\n :cc:subject:date:message-id:reply-to;\n bh=FYQGzs594jdHhZbeln97AvhkMwGywXvp35GsoC12Jg8=;\n b=je+py/co5NhLRfe330Acc80ki4fvcKK5f0Y9SC4C+rxfabKfEEzKwEHdRlKquEuqGQ\n PXMdy2yxp+W+uK3zo3T3W4SAJlUGCwvVYvtj4Mzr+s6bvUtYNOjodmwl4pgn2Z4KGVzQ\n TUEAh49p/NowTmSarNPkl7zHSa7Q2/cgRpArRt9eyG16wSoezAODebwJmtHJCIqjStwR\n gwkPcfAL3rTOVGl8ticV4BMD7KKiXTQk9esxfKBppYD8xw1ovoazjkTVj/y0VuvBddrn\n MgpkMdnezhquun5k4VD8C6eQukuxxTk5O7VcA1AlupflMJbfZJQQHrPZeTquEmCGiTDz\n kCiA==", "X-Gm-Message-State": "AOJu0YwvTg2EZwJfjKOS8VN1cHXiIkcMkhK1b27PkMiv5x3UnWdziWwM\n 5+Y+Hszt5ox4B5qWf5xzG36oTVEKPe8ZlH3RenoCj4fC4eeImJx/3cT79VFZ3Ye7Hr0sLYlq2dJ\n AZGr73gLLWf3I8a5Tl/0caxZ9jdYbahZDqaz9IRd8Zz5aCOcEII7cmHFrDZM6+I/Jvd51AVwG6C\n Fcaq3Ni2NQDKyDGg==", "X-Gm-Gg": "AeBDiesUTsBWddsBYYbHKJjz63CfvDPpZB48zVz9aZ7O1kQ1rmxkSCIfP00nJIXbqNB\n qrD585zbcBLXoJN1Y1Uygah4SYbvhLVVIQjQdpfMnvLaGS2o9FJZlBczPRrLl0aeKySPw6RoRLt\n ak4ifJ3dtmXPU5dpuxUKE5K1qGyzMsixSY5N3lWkGCQTyA9BB3XEBLtqy2cDL6LhTgr/I32sMzB\n dVglTTL59B6dN8gA7A35VqBU0zeqhZGFca7n4/+y9LZRYUDjIj+a1hlKVV5t0GQ8hjkXuHIVU74\n DjfmbBtyZZ5sSo9Jc2tVRVBA6zyfrihjdYmpOGbU3IWCVaS7xaIfvv6imsw3JMAXG16BAMexNHA\n ma7OT3Z/YNR9z+pJh/zzBRh9h025JmzGiUseQD+rtLNkp5hWZlQ92p/ueXJ7STp2xix8gP5S3UC\n GbMooa3l+WHymexzpvhgvT5ZKBKsiiNhfwzeWkYc500Yad0aM7rpmYeitHUuN0uU9whyBoCV39J\n 0olaQ==", "X-Received": [ "by 2002:a05:600c:2e0c:b0:48e:526e:1011 with SMTP id\n 5b1f17b1804b1-48e526e106bmr111022945e9.25.1778255010781;\n Fri, 08 May 2026 08:43:30 -0700 (PDT)", "by 2002:a05:600c:2e0c:b0:48e:526e:1011 with SMTP id\n 5b1f17b1804b1-48e526e106bmr111022545e9.25.1778255010054;\n Fri, 08 May 2026 08:43:30 -0700 (PDT)" ], "From": "Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>", "To": "kernel-team@lists.ubuntu.com", "Subject": "[SRU][J][PATCH 1/2] xfrm: esp: avoid in-place decrypt on shared skb\n frags", "Date": "Fri, 8 May 2026 17:42:53 +0200", "Message-ID": "\n <2769a8450bc3feebf4ec4be2ca55fa076e5e444e.1778254528.git.massimiliano.pellizzer@canonical.com>", "X-Mailer": "git-send-email 2.53.0", "In-Reply-To": "<cover.1778254528.git.massimiliano.pellizzer@canonical.com>", "References": "\n <177825404593.556137.16021374556820212124@tuxedo-infinitybook.public>\n <cover.1778254528.git.massimiliano.pellizzer@canonical.com>", "MIME-Version": "1.0", "X-BeenThere": "kernel-team@lists.ubuntu.com", "X-Mailman-Version": "2.1.20", "Precedence": "list", "List-Id": "Kernel team discussions <kernel-team.lists.ubuntu.com>", "List-Unsubscribe": "<https://lists.ubuntu.com/mailman/options/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=unsubscribe>", "List-Archive": "<https://lists.ubuntu.com/archives/kernel-team>", "List-Post": "<mailto:kernel-team@lists.ubuntu.com>", "List-Help": "<mailto:kernel-team-request@lists.ubuntu.com?subject=help>", "List-Subscribe": "<https://lists.ubuntu.com/mailman/listinfo/kernel-team>,\n <mailto:kernel-team-request@lists.ubuntu.com?subject=subscribe>", "Content-Type": "text/plain; charset=\"utf-8\"", "Content-Transfer-Encoding": "base64", "Errors-To": "kernel-team-bounces@lists.ubuntu.com", "Sender": "\"kernel-team\" <kernel-team-bounces@lists.ubuntu.com>" }, "content": "From: Kuan-Ting Chen <h3xrabbit@gmail.com>\n\ncommit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 upstream.\n\nMSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP\nmarks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),\nso later paths that may modify packet data can first make a private\ncopy. The IPv4/IPv6 datagram append paths did not set this flag when\nsplicing pages into UDP skbs.\n\nThat leaves an ESP-in-UDP packet made from shared pipe pages looking\nlike an ordinary uncloned nonlinear skb. ESP input then takes the no-COW\nfast path for uncloned skbs without a frag_list and decrypts in place\nover data that is not owned privately by the skb.\n\nMark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching\nTCP. Also make ESP input fall back to skb_cow_data() when the flag is\npresent, so ESP does not decrypt externally backed frags in place.\nPrivate nonlinear skb frags still use the existing fast path.\n\nThis intentionally does not change ESP output. In esp_output_head(),\nthe path that appends the ESP trailer to existing skb tailroom without\ncalling skb_cow_data() is not reachable for nonlinear skbs:\nskb_tailroom() returns zero when skb->data_len is nonzero, while ESP\ntailen is positive. Thus ESP output will either use the separate\ndestination-frag path or fall back to skb_cow_data().\n\nFixes: cac2661c53f3 (\"esp4: Avoid skb_cow_data whenever possible\")\nFixes: 03e2a30f6a27 (\"esp6: Avoid skb_cow_data whenever possible\")\nFixes: 7da0dde68486 (\"ip, udp: Support MSG_SPLICE_PAGES\")\nFixes: 6d8192bd69bb (\"ip6, udp6: Support MSG_SPLICE_PAGES\")\nReported-by: Hyunwoo Kim <imv4bel@gmail.com>\nReported-by: Kuan-Ting Chen <h3xrabbit@gmail.com>\nTested-by: Hyunwoo Kim <imv4bel@gmail.com>\nCc: stable@vger.kernel.org\nSigned-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>\nSigned-off-by: Steffen Klassert <steffen.klassert@secunet.com>\n[bwh: Backported to 6.1: set the SKBFL_SHARED_FRAG flag in\n ip_append_page() instead of __ip{,6}_append_data()]\nSigned-off-by: Ben Hutchings <benh@debian.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n(cherry picked from commit ab8b995323e5237041472d07e5055f5f7dcdf15b linux-5.15.y)\nCVE-2026-43284\nSigned-off-by: Massimiliano Pellizzer <massimiliano.pellizzer@canonical.com>\n---\n net/ipv4/esp4.c | 3 ++-\n net/ipv4/ip_output.c | 2 ++\n net/ipv6/esp6.c | 3 ++-\n 3 files changed, 6 insertions(+), 2 deletions(-)", "diff": "diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c\nindex 53170ecb2de08..66a23dbfd22b8 100644\n--- a/net/ipv4/esp4.c\n+++ b/net/ipv4/esp4.c\n@@ -918,7 +918,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)\n \t\t\tnfrags = 1;\n \n \t\t\tgoto skip_cow;\n-\t\t} else if (!skb_has_frag_list(skb)) {\n+\t\t} else if (!skb_has_frag_list(skb) &&\n+\t\t\t !skb_has_shared_frag(skb)) {\n \t\t\tnfrags = skb_shinfo(skb)->nr_frags;\n \t\t\tnfrags++;\n \ndiff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c\nindex d674a24217f90..68509e1f89b5b 100644\n--- a/net/ipv4/ip_output.c\n+++ b/net/ipv4/ip_output.c\n@@ -1443,6 +1443,8 @@ ssize_t\tip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,\n \t\t\tgoto error;\n \t\t}\n \n+\t\tskb_shinfo(skb)->tx_flags |= SKBFL_SHARED_FRAG;\n+\n \t\tif (skb->ip_summed == CHECKSUM_NONE) {\n \t\t\t__wsum csum;\n \t\t\tcsum = csum_page(page, offset, len);\ndiff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c\nindex cbe575ade34d6..4f5f50b8cf2d6 100644\n--- a/net/ipv6/esp6.c\n+++ b/net/ipv6/esp6.c\n@@ -965,7 +965,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)\n \t\t\tnfrags = 1;\n \n \t\t\tgoto skip_cow;\n-\t\t} else if (!skb_has_frag_list(skb)) {\n+\t\t} else if (!skb_has_frag_list(skb) &&\n+\t\t\t !skb_has_shared_frag(skb)) {\n \t\t\tnfrags = skb_shinfo(skb)->nr_frags;\n \t\t\tnfrags++;\n \n", "prefixes": [ "SRU", "J", "1/2" ] }