Norbert Szetei f66bdb1cc0 net: skbuff: don't touch shared zerocopy state in skb_tx_error() ... skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone shares, while the caller only owns the reference it is about to drop. Through a clone it tells the producer its pages are free and drops SKBFL_SHARED_FRAG for an skb that is still in flight. Open vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC: clone_execute() sends a skb_clone() into ovs_dp_process_packet() while do_execute_actions() keeps forwarding the original, and skb_clone() does not privatise the frags here -- skb_orphan_frags() returns early on SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker from the packet still being forwarded, and a later local ESP delivery decrypts in place over frags it does not own privately. Skip it for a cloned skb. Nothing is lost: skb_release_data() clears the zerocopy state once the last reference to the shared data goes. Fixes: 25121173f7 ("skb: api to report errors for zero copy skbs") Cc: stable@vger.kernel.org Suggested-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Norbert Szetei <norbert@doyensec.com> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Tested-by: Jongmin Jang <payload.jang@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/CFAB292A-674B-4C14-BB2C-BB8830AD5659@doyensec.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2026-08-25 09:36:47 +02:00
..
bpf_ksock.c	bpf: Add ksock kfuncs	2026-08-15 23:36:18 +02:00
bpf_sk_storage.c	bpf: Fix UAF in sock clone early bailouts	2026-07-09 18:44:16 +02:00
datagram.c	net: devmem: prevent net-iov / page mixing	2026-07-30 16:27:03 -07:00
dev_addr_lists_test.c	net: cache snapshot entries for ndo_set_rx_mode_async	2026-04-21 12:50:13 +02:00
dev_addr_lists.c	net: turn the rx_mode work into a generic netdev_work facility	2026-06-25 10:18:40 -07:00
dev_api.c	net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work	2026-04-21 12:50:03 +02:00
dev_ioctl.c	net: ethtool: make dev->hwprov ops-protected	2026-06-09 10:13:04 -07:00
dev.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-08-18 10:42:41 -07:00
dev.h	net: avoid theoretical races with ref drain	2026-08-06 09:37:03 -07:00
devmem.c	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
devmem.h	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
drop_monitor.c	drop_monitor: perform u64_stats updates under IRQ-disabled section	2026-07-23 11:00:01 -07:00
dst_cache.c	net: dst: annotate data-races around dst->obsolete	2025-07-02 14:32:29 -07:00
dst.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
failover.c	net: failover: check register_netdevice_notifier() error in failover_init()	2026-08-04 18:46:34 -07:00
fib_notifier.c	net: Add SPDX ids to some source files	2026-03-09 18:32:45 -07:00
fib_rules.c	net: fib_rules: Destroy ops->lock in fib_rules_unregister().	2026-07-07 10:51:06 +02:00
filter.c	bpf: Clear decap state on skb_adjust_room shrink path	2026-08-17 11:30:13 +02:00
flow_dissector.c	flow_dissector: check device type before reading ETH_ADDRS	2026-06-18 18:07:00 -07:00
flow_offload.c	Convert more 'alloc_obj' cases to default GFP_KERNEL arguments	2026-02-21 20:03:00 -08:00
gen_estimator.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
gen_stats.c	net/sched: add const qualifiers to gnet_stats helpers	2026-05-11 18:28:08 -07:00
gro_cells.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
gro.c	net: gro: fix double aggregation of flush-marked skbs	2026-07-21 08:30:54 -07:00
gso.c
hotdata.c	net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros	2026-03-29 11:21:22 -07:00
hwbm.c
ieee8021q_helpers.c	net: ieee8021q: fix insufficient table-size assertion	2025-07-01 12:55:49 +02:00
link_watch.c	net: rename netdev_ops_assert_locked()	2026-06-04 14:04:55 -07:00
lock_debug.c	net: require instance lock for NETDEV_DOWN/GOING_DOWN notifiers	2026-07-07 15:31:37 +02:00
lwt_bpf.c	lwt_bpf: Restore reserved headroom after xmit program	2026-08-17 10:59:03 +02:00
lwtunnel.c	net: lwtunnel: Drop skb metadata before LWT encapsulation	2026-06-23 19:07:23 -07:00
Makefile	bpf: Add ksock kfuncs	2026-08-15 23:36:18 +02:00
mp_dmabuf_devmem.h
neighbour.c	neighbour: remove obsolete EXPORT_SYMBOL()	2026-06-08 15:59:17 -07:00
net_namespace.c	net: add missing ref_tracker_dir_exit() to net_passive_dec()	2026-08-20 12:44:12 -07:00
net_test.c
net-procfs.c	net: add proper RCU protection to /proc/net/ptype	2026-02-03 19:20:30 -08:00
net-sysfs.c	net: add READ_ONCE()/WRITE_ONCE() annotations for dev->num_tc	2026-08-17 10:27:48 -07:00
net-sysfs.h	net: Defer netdev KOBJ_ADD uevent until the device is published	2026-08-06 09:36:18 -07:00
net-traces.c
netclassid_cgroup.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
netdev_config.c	net: add queue config validation callback	2026-01-23 11:49:02 -08:00
netdev_queues.c	net: expect instance lock in netdev_queue_get_dma_dev()	2026-08-10 15:54:42 -07:00
netdev_rx_queue.c	net: Stop leased rxq before uninstalling its memory provider	2026-06-11 15:57:39 -07:00
netdev_work.c	net: avoid theoretical races with ref drain	2026-08-06 09:37:03 -07:00
netdev-genl-gen.c	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
netdev-genl-gen.h	net: devmem: allow rx-page-size > PAGE_SIZE per dmabuf binding	2026-08-07 18:32:39 -07:00
netdev-genl.c	netdev: check for nla_put_u32() failures	2026-08-10 16:38:40 -07:00
netevent.c
netmem_priv.h	Revert "mm: introduce a new page type for page pool in page type"	2026-05-21 19:06:13 -07:00
netpoll.c	netconsole: move netpoll_wait_carrier() as netcons_wait_carrier()	2026-07-30 12:14:39 +02:00
netprio_cgroup.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
of_net.c
page_pool_priv.h	net: page_pool: don't try to stash the napi id	2025-01-27 14:37:41 -08:00
page_pool_user.c	net: make page_pool_get_stats() void	2026-05-28 18:10:03 -07:00
page_pool.c	net: page_pool: Remove zone/policy GFP flags when allocating XArray entries	2026-08-22 13:28:14 -07:00
pktgen.c	net: pktgen: use a consistent flow count	2026-08-17 12:50:51 -07:00
ptp_classifier.c
rtnetlink.c	rtnetlink: cap IFLA_VFINFO_LIST at a documented number of VFs	2026-08-06 12:42:49 +02:00
scm.c	net: af_unix: useful handling of LSM denials on SCM_RIGHTS	2026-08-17 18:14:52 -07:00
secure_seq.c	tcp: secure_seq: add back ports to TS offset	2026-03-04 17:44:35 -08:00
selftests.c	net: Use helpers to get/set UDP len tree-wide	2026-07-22 13:47:02 +02:00
skb_fault_injection.c	net: Implement fault injection forcing skb reallocation	2024-11-12 12:05:33 +01:00
skbuff.c	net: skbuff: don't touch shared zerocopy state in skb_tx_error()	2026-08-25 09:36:47 +02:00
skmsg.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-06-16 14:59:58 -07:00
sock_diag.c	net: Add SPDX ids to some source files	2026-03-09 18:32:45 -07:00
sock_map.c	bpf, sockmap: Use sock_hold() instead of refcount_inc_not_zero() in lookup	2026-08-17 10:22:19 +02:00
sock_reuseport.c	treewide: Replace kmalloc with kmalloc_obj for non-scalar types	2026-02-21 01:02:28 -08:00
sock.c	net: remove WARN_ON_ONCE() from sk_mc_loop()	2026-08-06 13:10:16 +02:00
stream.c	net: remove some unused EXPORT_SYMBOL()s	2026-06-12 16:43:11 -07:00
sysctl_net_core.c	net: Const qualify network templated ctl_tables Arrays	2026-08-13 13:12:24 +02:00
timestamping.c	net: Add the possibility to support a selected hwtstamp in netdevice	2024-12-16 12:51:40 +00:00
tso.c	net: Use helpers to get/set UDP len tree-wide	2026-07-22 13:47:02 +02:00
utils.c	kernel.h: drop hex.h and update all hex.h users	2026-01-20 19:44:19 -08:00
xdp.c	xdp: fix zero-copy frame layout	2026-08-22 13:10:48 -07:00