From: Norbert Szetei <norbert@doyensec.com> mainline inclusion from mainline-v7.3-rc1 commit f66bdb1cc0fcd227a062378f8be0b5873aa5600a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19120 CVE: CVE-2026-90049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- skb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears SKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone shares, while the caller only owns the reference it is about to drop. Through a clone it tells the producer its pages are free and drops SKBFL_SHARED_FRAG for an skb that is still in flight. Open vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC: clone_execute() sends a skb_clone() into ovs_dp_process_packet() while do_execute_actions() keeps forwarding the original, and skb_clone() does not privatise the frags here -- skb_orphan_frags() returns early on SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker from the packet still being forwarded, and a later local ESP delivery decrypts in place over frags it does not own privately. Skip it for a cloned skb. Nothing is lost: skb_release_data() clears the zerocopy state once the last reference to the shared data goes. Fixes: 25121173f7b1 ("skb: api to report errors for zero copy skbs") Cc: stable@vger.kernel.org Suggested-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Norbert Szetei <norbert@doyensec.com> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Tested-by: Jongmin Jang <payload.jang@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/CFAB292A-674B-4C14-BB2C-BB8830AD5659@doyensec.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Conflicts: net/core/skbuff.c [Conflicts are caused by the following patches not being merged: skb_tx_error() lacks the if (skb) wrapper and the skb_zcopy_downgrade_managed() call (managed-frags infra absent): 753f1ca4e1e5 ("net: introduce managed frags infrastructure")] Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> --- net/core/skbuff.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 17594aa4124d7..63113e9176bbd 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -691,10 +691,14 @@ EXPORT_SYMBOL(kfree_skb_list); * * Report xmit error if a device callback is tracking this skb. * skb must be freed afterwards. + * + * Does nothing for a cloned skb: the zerocopy state lives in + * skb_shinfo(), which the clones share. */ void skb_tx_error(struct sk_buff *skb) { - skb_zcopy_clear(skb, true); + if (skb && !skb_cloned(skb)) + skb_zcopy_clear(skb, true); } EXPORT_SYMBOL(skb_tx_error); -- 2.33.8