Re: [PATCH net] octeontx2-pf: fix skb use-after-free with ipsec crypto offload

[Jakub Kicinski]

On Mon, 19 Oct 2026 17:04:33 +0200 Nicolai Buchwitz wrote:
> +	/* Crypto hardware need write permission for ipsec crypto offload */
> +	if (unlikely(xfrm_offload(skb)) && skb_cloned(skb) &&
> +	    skb_ensure_writable(skb, skb->len)) {
> +		dev_kfree_skb_any(skb);
> +		return true;
> +	}

Why just for cloned packets? Frags themselves may be read only
if they are spliced filesystem pages.