From: Maciej Fijalkowski <maciej.fijalkowski@intel.com> mainline inclusion from mainline-v6.18-rc1 commit c30d084960cf316c95fbf145d39974ce1ff7889c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17327 CVE: CVE-2026-74559 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- We are unnecessarily setting a bunch of skb fields per each processed descriptor, which is redundant for fragmented frames. Let us set these respective members for first fragment only. To address both paths that we have within xsk_build_skb(), move assignments onto xsk_set_destructor_arg() and rename it to xsk_skb_init_misc(). Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Jason Xing <kerneljasonxing@gmail.com> Acked-by: Martin KaFai Lau <martin.lau@kernel.org> Link: https://patch.msgid.link/20250925160009.2474816-2-maciej.fijalkowski@intel.c... Signed-off-by: Jakub Kicinski <kuba@kernel.org> Conflicts: net/xdp/xsk.c [Commit 48eb03dd2630, 0c0d0f42ffa6 and 10bbf1652c1c not merged.] Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com> --- net/xdp/xsk.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index c7f4dba..bd62be54 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -590,11 +590,16 @@ static void xsk_destruct_skb(struct sk_buff *skb) sock_wfree(skb); } -static void xsk_set_destructor_arg(struct sk_buff *skb, u64 addr) +static void xsk_skb_init_misc(struct sk_buff *skb, struct xdp_sock *xs, + u64 addr) { BUILD_BUG_ON(sizeof(struct xsk_addr_head) > sizeof(skb->cb)); INIT_LIST_HEAD(&XSKCB(skb)->addrs_list); + skb->dev = xs->dev; + skb->priority = xs->sk.sk_priority; + skb->mark = READ_ONCE(xs->sk.sk_mark); XSKCB(skb)->num_descs = 0; + skb->destructor = xsk_destruct_skb; skb_shinfo(skb)->destructor_arg = (void *)(uintptr_t)addr; } @@ -645,7 +650,7 @@ static struct sk_buff *xsk_build_skb_zerocopy(struct xdp_sock *xs, skb_reserve(skb, hr); - xsk_set_destructor_arg(skb, desc->addr); + xsk_skb_init_misc(skb, xs, desc->addr); } else { xsk_addr = kmem_cache_zalloc(xsk_tx_generic_cache, GFP_KERNEL); if (!xsk_addr) @@ -727,7 +732,7 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs, goto free_err; } - xsk_set_destructor_arg(skb, desc->addr); + xsk_skb_init_misc(skb, xs, desc->addr); } else { int nr_frags = skb_shinfo(skb)->nr_frags; struct xsk_addr_node *xsk_addr; @@ -764,10 +769,6 @@ static struct sk_buff *xsk_build_skb(struct xdp_sock *xs, } } - skb->dev = dev; - skb->priority = xs->sk.sk_priority; - skb->mark = READ_ONCE(xs->sk.sk_mark); - skb->destructor = xsk_destruct_skb; xsk_inc_num_desc(skb); return skb; -- 2.9.5