Re: [PATCH ipsec] xfrm: esp: reset outer TCP GSO metadata on espintcp input

[杨国帅]

From: Guoshuai Yang <yangguoshuai@xxxxxxxxx>

On Mon, Oct 19, 2026 at 12:53:25AM +0000, netdev-bot+sashiko@xxxxxxxxxx wrote:
> [Severity: Medium]
> 
> Does this reset only reach the head skb? skb_gso_reset() writes to
> skb_shinfo(skb) only, and the frag_list members seem to keep the outer
> TCP GSO state.
> 
> In the case the commit message describes, strparser chains a cloned
> spillover member onto frag_list. skb_cow_data() then replaces that member
> with skb_copy(), and skb_copy_header() copies the GSO fields over from
> the shared outer TCP shinfo:
...
> Could the GSO fields also be cleared on each skb_walk_frags() member at
> skip_cow, in both esp_input() and esp6_input()? The members should be
> private there, because skb_cow_data() copies every cloned or nonlinear
> member.

Good catch. Indeed, skb_cow_data() copies cloned frag_list members via
skb_copy() -> skb_copy_header(), which preserves the outer TCP GSO
fields on those members. If the decrypted inner packet later takes the
ip_do_fragment() frag_list fast path, each detached member still carries
stale outer GSO metadata when reaching validate_xmit_skb().

I will send a v2 that also clears the GSO state on each skb_walk_frags()
member at skip_cow in both esp_input() and esp6_input().

pw-bot: cr