snlavaise/pmaports-rtwo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

linux-postmarketos-stable: Upgrade to 7.0.7

Browse Source 
Part-of: <https://gitlab.postmarketos.org/postmarketOS/pmaports/-/merge_requests/8564>
This commit is contained in:
Aelin
2026-05-15 00:15:08 +02:00
committed by The Friendly Meow (merge) Bot
parent 0fefc4d2e7
commit fa890a3978
9 changed files with 16 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files
device/main/linux-postmarketos-stable/0004-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch
-99
View File
@@ -1,99 +0,0 @@
From f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Mon Sep 17 00:00:00 2001
From: Kuan-Ting Chen <h3xrabbit@gmail.com>
Date: Mon, 4 May 2026 23:27:12 +0800
Subject: [PATCH] xfrm: esp: avoid in-place decrypt on shared skb frags
MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP
marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),
so later paths that may modify packet data can first make a private
copy. The IPv4/IPv6 datagram append paths did not set this flag when
splicing pages into UDP skbs.
That leaves an ESP-in-UDP packet made from shared pipe pages looking
like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW
fast path for uncloned skbs without a frag_list and decrypts in place
over data that is not owned privately by the skb.
Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching
TCP. Also make ESP input fall back to skb_cow_data() when the flag is
present, so ESP does not decrypt externally backed frags in place.
Private nonlinear skb frags still use the existing fast path.
This intentionally does not change ESP output. In esp_output_head(),
the path that appends the ESP trailer to existing skb tailroom without
calling skb_cow_data() is not reachable for nonlinear skbs:
skb_tailroom() returns zero when skb->data_len is nonzero, while ESP
tailen is positive. Thus ESP output will either use the separate
destination-frag path or fall back to skb_cow_data().
Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible")
Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible")
Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES")
Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES")
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Reported-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
Tested-by: Hyunwoo Kim <imv4bel@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
---
net/ipv4/esp4.c | 3 ++-
net/ipv4/ip_output.c | 2 ++
net/ipv6/esp6.c | 3 ++-
net/ipv6/ip6_output.c | 2 ++
4 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 6dfc0bcdef6542..6a5febbdbee493 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -873,7 +873,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
nfrags = 1;
goto skip_cow;
- } else if (!skb_has_frag_list(skb)) {
+ } else if (!skb_has_frag_list(skb) &&
+ !skb_has_shared_frag(skb)) {
nfrags = skb_shinfo(skb)->nr_frags;
nfrags++;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index e4790cc7b5c2ec..5bcd73cbdb41c0 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1233,6 +1233,8 @@ static int __ip_append_data(struct sock *sk,
if (err < 0)
goto error;
copy = err;
+ if (!(flags & MSG_NO_SHARED_FRAGS))
+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
wmem_alloc_delta += copy;
} else if (!zc) {
int i = skb_shinfo(skb)->nr_frags;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 9f75313734f8cd..9c06c5a1419dc4 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -915,7 +915,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
nfrags = 1;
goto skip_cow;
- } else if (!skb_has_frag_list(skb)) {
+ } else if (!skb_has_frag_list(skb) &&
+ !skb_has_shared_frag(skb)) {
nfrags = skb_shinfo(skb)->nr_frags;
nfrags++;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7e92909ab5be3f..1f2a33fbed6e63 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1794,6 +1794,8 @@ static int __ip6_append_data(struct sock *sk,
if (err < 0)
goto error;
copy = err;
+ if (!(flags & MSG_NO_SHARED_FRAGS))
+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
wmem_alloc_delta += copy;
} else if (!zc) {
int i = skb_shinfo(skb)->nr_frags;
device/main/linux-postmarketos-stable/APKBUILD
+9 -11
View File
@@ -1,7 +1,7 @@
# Co-Maintainer: Achill Gilgenast <achill@achill.org>
maintainer="Aelin <aelin@postmarketos.org>"
pkgname=linux-postmarketos-stable
pkgver=7.0.4
pkgver=7.0.7
pkgrel=0
_kver=${pkgver%.*}
pkgdesc="Stable Kernel"
@@ -63,7 +63,6 @@ source="
0001-WIP-arch-powerpc-boot-Support-LLVM-1-in-wrapper-scri.patch
0002-WIP-arch-powerpc-boot-Use-z-notext-for-pseries-image.patch
0003-WIP-arch-powerpc-boot-Add-z-norelro.patch
0004-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch
config-stable.aarch64
config-stable.armv7
@@ -125,17 +124,16 @@ package() {
}
sha512sums="
cbabaa8a17a8ef71b764dc140155575eb2288cc25ced4b36209fd2aaeba256b35234de8507844ac7798a0c1bcd24840bea2db459d8cf0fe9e3467ddd7fe7b168 patch-7.0.4.patch.xz
a9d9d4d7349cabcb688c148f5ce777390590628ef320863363016bacd701c8c61348756ca1f869ea41da7716dd73b85ad5b9b447c7ecfadc106c428f9c597cb3 patch-7.0.7.patch.xz
8c85b708342f8f09ca25b2234b22e93b62b144a9ef919fbb21827f52fa47498e778c79db1559524dd7fb360f95b2ce174171443c1859656c281be41d2b6c5a0b linux-7.0.tar.xz
1f11df2480e9f691573283597160b4c806e492cdca4825f3acb3afb70bde43abfab487bcde1f5553b431a702a0039479d041b0ce7859970e706b5a51d2ad8fb0 0001-WIP-arch-powerpc-boot-Support-LLVM-1-in-wrapper-scri.patch
26521a9c9ea769534095dc4e306babadc8bcbaf03d7faa523c377e41ba0f742ecd0490fa27791d895f729c3ae8845297dca59b4db2475e7f078e689c447430bc 0002-WIP-arch-powerpc-boot-Use-z-notext-for-pseries-image.patch
302c20c85559fc9b3b2420ed25be1bfbb76c87f2a470e4141c32e9542cf1f5c6b3b5a7847231a3eaa0f6bc0e5942d0c1599e807175dcf5e63469704c3d6adde3 0003-WIP-arch-powerpc-boot-Add-z-norelro.patch
2adacf5b985fc7f2adec208e38974e7d0960a425f28a33218d1e52f749f2262f12b3fdad16e3f636dce00c71bff94f6a178961e2572bc0499803a786972ddffc 0004-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch
bac38afb64b40be4d0588ad8e992c383d9b2a1e515739e8b8153c6c721adac03bbe865d93b2378a5d2fbe21739551ef61a99327e374d28a771c146e05fac8044 config-stable.aarch64
b9ad950d1ce297fab80a53dd353a0a723f5b971c629120a4fbc8ae08f5b466ae69422208f8ec5e57645af9e6efe13d3b43b13cc010bfc9c05e38bd70ed7af5a4 config-stable.armv7
7b8cff42f803b69ec36b302992c519540ef97923bcacd4a0b30bef79279ee5b81bc553a060ae0db9527265bee9c09d3d2d5beb3122215f655691cfdd15185e7b config-stable.loongarch64
49c365419f64bf6239b689082516e64dae0a3b546c0b7fa92ac7735a496a5809aa80443299379c3b40fabc1bcc80dc4144f92c53548ded24f837c03bb823c06c config-stable.ppc64le
60226d778dc10e03a245523b0ee0d9a65393be292dde4219128c067c80f18eaa6570976d34a4cc9fb1056c76afdab60346d517a35f05a6fd93015d54b924371f config-stable.riscv64
3822d00da47579a49b476f228882f3326a01b905392d0eb23d092033ffec6e0cdfbff829e5ef898c24b1aaebc04998badca983be86d44907347a64e9ceaefa0c config-stable.x86
2f4fa6fd514d23b59c6df845f71e97ac776c040e7ef01f2b66211c2bdc67ce7195c0fc9a07f7cba9a825ba1a9159e10a473fce1e789e849d51a500fb67f5d52f config-stable.x86_64
77d7346a720c17b9517e6dbb0748ccff821ca823ff0d0632e6be188a8eeb7199cf1b0250919a5fb11e573d7f42eeeeba6519562b49778750042de7e0b2b9b55e config-stable.aarch64
9800c7b070ab4af4be1ec146a5327abd6971b84ae1b3ab08283d2c9c508c3647259700ee749abdab017673f452ffc698159111141326366377c878b3c285836c config-stable.armv7
372d6d667afc8b6fb6fc63f3a366a8e01d027f55ba1a0510bda5aa3cbac7955a593fba6ef4edba2434e940de0a758cb22c733c70331a91ba5e3f4281e6a73cb6 config-stable.loongarch64
aed1f719411c65975e7587381a6c048748e06cbe9df57d6a0c756ddda699d69552ba7c50b1128aee4fe178e3982473840e59d1384dbe4eec876e1e0c7ac97f62 config-stable.ppc64le
608400864d9b2e9f73f840143be13b35c85fbd454e9cbd5c5a4516ef160d1653e7425425ca01408e5a5f33f46427926752a6f553c86ab032f698527a9798a87e config-stable.riscv64
4a9564050bf274b926ea9370d568375a1ef1e9598015b200bbf059cbbdc9d521298857f818a3833e5ab8bc13d72bde1b278e051816fa917df481900632dd5eba config-stable.x86
b932a8cf94ebb94c63a8a971c4cdfd9293dcf3693cc6a32e6ed347af5b90c58df2c2d3d596b6a45748ef31cb78fd3281dd11f73a8375579082d3d31560ad8fcc config-stable.x86_64
"
device/main/linux-postmarketos-stable/config-stable.aarch64
+1 -1
View File
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
# Linux/arm64 7.0.4 Kernel Configuration
# Linux/arm64 7.0.7 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3"
CONFIG_GCC_VERSION=0
device/main/linux-postmarketos-stable/config-stable.armv7
+1 -1
View File
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
# Linux/arm 7.0.4 Kernel Configuration
# Linux/arm 7.0.7 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3"
CONFIG_GCC_VERSION=0
device/main/linux-postmarketos-stable/config-stable.loongarch64
+1 -1
View File
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
# Linux/loongarch 7.0.4 Kernel Configuration
# Linux/loongarch 7.0.7 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3"
CONFIG_GCC_VERSION=0
device/main/linux-postmarketos-stable/config-stable.ppc64le
+1 -2
View File
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
# Linux/powerpc 7.0.4 Kernel Configuration
# Linux/powerpc 7.0.7 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3"
CONFIG_GCC_VERSION=0
@@ -7570,7 +7570,6 @@ CONFIG_RATIONAL=y
CONFIG_GENERIC_IOMAP=y
CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y
CONFIG_ARCH_HAS_FAST_MULTIPLIER=y
CONFIG_CRC7=m
CONFIG_CRC8=m
CONFIG_CRC16=y
CONFIG_CRC_CCITT=m
device/main/linux-postmarketos-stable/config-stable.riscv64
+1 -1
View File
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
# Linux/riscv 7.0.4 Kernel Configuration
# Linux/riscv 7.0.7 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3"
CONFIG_GCC_VERSION=0
device/main/linux-postmarketos-stable/config-stable.x86
+1 -1
View File
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
# Linux/i386 7.0.4 Kernel Configuration
# Linux/i386 7.0.7 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3"
CONFIG_GCC_VERSION=0
device/main/linux-postmarketos-stable/config-stable.x86_64
+1 -1
View File
@@ -1,6 +1,6 @@
#
# Automatically generated file; DO NOT EDIT.
# Linux/x86_64 7.0.4 Kernel Configuration
# Linux/x86_64 7.0.7 Kernel Configuration
#
CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3"
CONFIG_GCC_VERSION=0