rpms/kernel
9
4
Fork 6
Code Issues Pull Requests Releases Activity

Bump version to 6.12.0-124.55.2

Browse Source 
xfrm: esp: avoid in-place decrypt on shared skb frags
(upstream commit f4c50a4034e6)
This commit is contained in:
Andrew Lukoshko 2026-05-07 17:27:18 +00:00
parent 5cd45f88d2
commit bc220d7495
2 changed files with 84 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
1100-xfrm-esp-avoid-in-place-decrypt-shared-skb-frags.patch Normal file
View File

@ -0,0 +1,77 @@
From: Andrew Lukoshko <alukoshko@almalinux.org>
Subject: [PATCH AlmaLinux 10] xfrm: esp: avoid in-place decrypt on shared skb frags
Direct cherry-pick of upstream commit f4c50a4034e6 for AlmaLinux 10
(6.12 kernel).
Verified to apply with `patch -p1 -F0` (no offset, no fuzz, no rejects)
against kernel-6.12.0-124.55.1.el10_1.
ESP-in-UDP packets built from MSG_SPLICE_PAGES (pipe pages) look like
ordinary uncloned nonlinear skbs to ESP input, which takes the no-COW
fast path and decrypts in place over data that is not owned privately
by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG
matching TCP, and make ESP input fall back to skb_cow_data() when the
flag is present.
Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES")
Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES")
(cherry picked from commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4)
Signed-off-by: Andrew Lukoshko <alukoshko@almalinux.org>
---
net/ipv4/esp4.c | 3 ++-
net/ipv4/ip_output.c | 2 ++
net/ipv6/esp6.c | 3 ++-
net/ipv6/ip6_output.c | 2 ++
4 files changed, 8 insertions(+), 2 deletions(-)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -908,7 +908,8 @@
nfrags = 1;
goto skip_cow;
- } else if (!skb_has_frag_list(skb)) {
+ } else if (!skb_has_frag_list(skb) &&
+ !skb_has_shared_frag(skb)) {
nfrags = skb_shinfo(skb)->nr_frags;
nfrags++;
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1236,6 +1236,8 @@
if (err < 0)
goto error;
copy = err;
+ if (!(flags & MSG_NO_SHARED_FRAGS))
+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
wmem_alloc_delta += copy;
} else if (!zc) {
int i = skb_shinfo(skb)->nr_frags;
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -950,7 +950,8 @@
nfrags = 1;
goto skip_cow;
- } else if (!skb_has_frag_list(skb)) {
+ } else if (!skb_has_frag_list(skb) &&
+ !skb_has_shared_frag(skb)) {
nfrags = skb_shinfo(skb)->nr_frags;
nfrags++;
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1769,6 +1769,8 @@
if (err < 0)
goto error;
copy = err;
+ if (!(flags & MSG_NO_SHARED_FRAGS))
+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
wmem_alloc_delta += copy;
} else if (!zc) {
int i = skb_shinfo(skb)->nr_frags;
--
2.43.0

9
kernel.spec
View File

@ -176,13 +176,13 @@ Summary: The Linux kernel
%define specrpmversion 6.12.0
%define specversion 6.12.0
%define patchversion 6.12
%define pkgrelease 124.55.1
%define pkgrelease 124.55.2
%define kversion 6
%define tarfile_release 6.12.0-124.55.1.el10_1
# This is needed to do merge window version magic
%define patchlevel 12
# This allows pkg_release to have configurable %%{?dist} tag
%define specrelease 124.55.1%{?buildid}%{?dist}
%define specrelease 124.55.2%{?buildid}%{?dist}
# This defines the kabi tarball version
%define kabiversion 6.12.0-124.55.1.el10_1
@ -1128,6 +1128,7 @@ Patch2007: 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch
Patch2008: 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch
Patch2009: 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch
Patch2010: 0010-Bring-back-deprecated-pci-ids-to-aacraid-driver.patch
Patch1100: 1100-xfrm-esp-avoid-in-place-decrypt-shared-skb-frags.patch
# END OF PATCH DEFINITIONS
@ -1989,6 +1990,7 @@ ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch
ApplyPatch 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch
ApplyPatch 0009-Bring-back-deprecated-pci-ids-to-mpt3sas-driver.patch
ApplyPatch 0010-Bring-back-deprecated-pci-ids-to-aacraid-driver.patch
ApplyPatch 1100-xfrm-esp-avoid-in-place-decrypt-shared-skb-frags.patch
%{log_msg "End of patch applications"}
# END OF PATCH APPLICATIONS
@ -4377,6 +4379,9 @@ fi\
#
#
%changelog
* Thu May 07 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-124.55.2
- xfrm: esp: avoid in-place decrypt on shared skb frags
* Wed May 06 2026 Eduard Abdullin <eabdullin@almalinux.org> - 6.12.0-124.55.1
- Debrand for AlmaLinux OS
- Use AlmaLinux OS secure boot cert