Bump version to 4.18.0-553.124.2

net: skbuff: propagate shared-frag marker through pskb_copy()

Backport of https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/
adapted to the 4.18 SKBTX_SHARED_FRAG / shinfo->tx_flags API.

__pskb_copy_fclone() and skb_try_coalesce() shallow-copied frag
descriptors without propagating SKBTX_SHARED_FRAG, so destinations
referencing externally-owned pages reported skb_has_shared_frag()
as false. Set the bit on the destination whenever frag descriptors
were actually moved from the source.

Reintroduce the tarfile_release indirection so pkgrelease can
advance independently of the imported source tarball.

SOURCES/1100-net-skbuff-propagate-shared-frag-marker.patch

@@ -0,0 +1,65 @@
+From: Andrew Lukoshko <alukoshko@almalinux.org>
+Subject: [PATCH AlmaLinux 8] net: skbuff: propagate shared-frag marker through pskb_copy()
+
+Backport of upstream patch posted at
+https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/
+(sibling to upstream commit f4c50a4034e6 "xfrm: esp: avoid in-place
+decrypt on shared skb frags").
+
+__pskb_copy_fclone() shallow-copies the source's frag descriptors and
+bumps each page's refcount via skb_frag_ref(), then defers the rest
+of the shinfo metadata to skb_copy_header().  That helper only carries
+over gso_{size,segs,type} and never touches skb_shinfo()->tx_flags,
+so the destination skb keeps a reference to the same externally-owned
+or page-cache-backed pages while reporting skb_has_shared_frag() as
+false.
+
+The mismatch is harmful in any in-place writer that uses
+skb_has_shared_frag() to decide whether shared pages must be detoured
+through skb_cow_data().
+
+Set SKBTX_SHARED_FRAG on the destination whenever frag descriptors
+were actually moved from the source.  skb_copy() and skb_copy_expand()
+share skb_copy_header() too but linearize all paged data into freshly
+allocated head storage and emerge with nr_frags == 0, so
+skb_has_shared_frag() returns false on its own; they need no change.
+
+Tree adaptation:
+  * Upstream introduces skb_shinfo()->flags and SKBFL_SHARED_FRAG
+    (commit 06b4feb37e69, v5.16). AlmaLinux 8 (4.18 kernel) still
+    uses the original SKBTX_SHARED_FRAG bit in skb_shinfo()->tx_flags,
+    which is also what skb_has_shared_frag() consults here. Translate
+    the new field/macro back to the legacy ones.
+
+Verified to apply with `patch -p1 -F0` (no offset, no fuzz, no rejects)
+against kernel-4.18.0-553.124.1.el8_10.
+
+Fixes: cef401de7be8 ("net: fix possible wrong checksum generation")
+Reported-by: William Bowling <vakzz@zellic.io>
+Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
+Signed-off-by: Andrew Lukoshko <alukoshko@almalinux.org>
+---
+ net/core/skbuff.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -1807,6 +1807,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom,
+ 			skb_frag_ref(skb, i);
+ 		}
+ 		skb_shinfo(n)->nr_frags = i;
++		skb_shinfo(n)->tx_flags |= skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
+ 	}
+
+ 	if (skb_has_frag_list(skb)) {
+@@ -5576,6 +5577,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
+ 	       from_shinfo->frags,
+ 	       from_shinfo->nr_frags * sizeof(skb_frag_t));
+ 	to_shinfo->nr_frags += from_shinfo->nr_frags;
++	if (from_shinfo->nr_frags)
++		to_shinfo->tx_flags |= from_shinfo->tx_flags & SKBTX_SHARED_FRAG;
+
+ 	if (!skb_cloned(from))
+ 		from_shinfo->nr_frags = 0;
+--
+2.43.0

SPECS/kernel.spec

@@ -38,10 +38,11 @@
 # define buildid .local
 
 %define specversion 4.18.0
-%define pkgrelease 553.124.1.el8_10
+%define pkgrelease 553.124.2.el8_10
+%define tarfile_release 553.124.1.el8_10
 
 # allow pkg_release to have configurable %%{?dist} tag
-%define specrelease 553.124.1%{?dist}
+%define specrelease 553.124.2%{?dist}
 
 %define pkg_release %{specrelease}%{?buildid}
 
@@ -435,7 +436,7 @@ BuildRequires: xmlto
 BuildRequires: asciidoc
 %endif
 
-Source0: linux-%{specversion}-%{pkgrelease}.tar.xz
+Source0: linux-%{specversion}-%{tarfile_release}.tar.xz
 
 Source9: x509.genkey
 
@@ -538,6 +539,7 @@ Patch2005: 0005-Bring-back-deprecated-pci-ids-to-qla2xxx-driver.patch
 Patch2006: 0006-Bring-back-deprecated-pci-ids-to-lpfc-driver.patch
 Patch2007: 0007-Bring-back-deprecated-pci-ids-to-qla4xxx-driver.patch
 Patch2008: 0008-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch
+Patch1100: 1100-net-skbuff-propagate-shared-frag-marker.patch
 
 # END OF PATCH DEFINITIONS
 
@@ -1096,9 +1098,9 @@ ApplyOptionalPatch()
   fi
 }
 
-%setup -q -n %{name}-%{specversion}-%{pkgrelease} -c
+%setup -q -n %{name}-%{specversion}-%{tarfile_release} -c
-cp -v %{SOURCE9000} linux-%{specversion}-%{pkgrelease}/certs/rhel.pem
+cp -v %{SOURCE9000} linux-%{specversion}-%{tarfile_release}/certs/rhel.pem
-mv linux-%{specversion}-%{pkgrelease} linux-%{KVERREL}
+mv linux-%{specversion}-%{tarfile_release} linux-%{KVERREL}
 
 cd linux-%{KVERREL}
 
@@ -1115,6 +1117,7 @@ ApplyPatch 0005-Bring-back-deprecated-pci-ids-to-qla2xxx-driver.patch
 ApplyPatch 0006-Bring-back-deprecated-pci-ids-to-lpfc-driver.patch
 ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-qla4xxx-driver.patch
 ApplyPatch 0008-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch
+ApplyPatch 1100-net-skbuff-propagate-shared-frag-marker.patch
 
 # END OF PATCH APPLICATIONS
 
@@ -2713,6 +2716,9 @@ fi
 #
 #
 %changelog
+* Wed May 13 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 4.18.0-553.124.2
+- net: skbuff: propagate shared-frag marker through pskb_copy()
+
 * Tue May 12 2026 Andrei Lukoshko <alukoshko@almalinux.org> - 4.18.0-553.124.1
 - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024