Re: [PATCH net] octeontx2-pf: fix skb use-after-free with ipsec crypto offload
From: Nicolai Buchwitz
Date: Thu Oct 22 2026 - 04:58:08 EST
On 22.10.2026 02:08, Jakub Kicinski wrote:
On Mon, 19 Oct 2026 17:04:33 +0200 Nicolai Buchwitz wrote:
+ /* Crypto hardware need write permission for ipsec crypto offload */
+ if (unlikely(xfrm_offload(skb)) && skb_cloned(skb) &&
+ skb_ensure_writable(skb, skb->len)) {
+ dev_kfree_skb_any(skb);
+ return true;
+ }
Why just for cloned packets? Frags themselves may be read only
if they are spliced filesystem pages.
Right, spliced or zerocopy pages would be encrypted in place too. I'll send a v2.
Thanks,
Nicolai
--
pw-bot: cr