diff --git a/device/main/linux-postmarketos-stable/0004-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/device/main/linux-postmarketos-stable/0004-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch deleted file mode 100644 index 49263be0f..000000000 --- a/device/main/linux-postmarketos-stable/0004-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch +++ /dev/null @@ -1,99 +0,0 @@ -From f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 Mon Sep 17 00:00:00 2001 -From: Kuan-Ting Chen -Date: Mon, 4 May 2026 23:27:12 +0800 -Subject: [PATCH] xfrm: esp: avoid in-place decrypt on shared skb frags - -MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP -marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), -so later paths that may modify packet data can first make a private -copy. The IPv4/IPv6 datagram append paths did not set this flag when -splicing pages into UDP skbs. - -That leaves an ESP-in-UDP packet made from shared pipe pages looking -like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW -fast path for uncloned skbs without a frag_list and decrypts in place -over data that is not owned privately by the skb. - -Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching -TCP. Also make ESP input fall back to skb_cow_data() when the flag is -present, so ESP does not decrypt externally backed frags in place. -Private nonlinear skb frags still use the existing fast path. - -This intentionally does not change ESP output. In esp_output_head(), -the path that appends the ESP trailer to existing skb tailroom without -calling skb_cow_data() is not reachable for nonlinear skbs: -skb_tailroom() returns zero when skb->data_len is nonzero, while ESP -tailen is positive. Thus ESP output will either use the separate -destination-frag path or fall back to skb_cow_data(). - -Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") -Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") -Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") -Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") -Reported-by: Hyunwoo Kim -Reported-by: Kuan-Ting Chen -Tested-by: Hyunwoo Kim -Cc: stable@vger.kernel.org -Signed-off-by: Kuan-Ting Chen -Signed-off-by: Steffen Klassert ---- - net/ipv4/esp4.c | 3 ++- - net/ipv4/ip_output.c | 2 ++ - net/ipv6/esp6.c | 3 ++- - net/ipv6/ip6_output.c | 2 ++ - 4 files changed, 8 insertions(+), 2 deletions(-) - -diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c -index 6dfc0bcdef6542..6a5febbdbee493 100644 ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -873,7 +873,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index e4790cc7b5c2ec..5bcd73cbdb41c0 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1233,6 +1233,8 @@ static int __ip_append_data(struct sock *sk, - if (err < 0) - goto error; - copy = err; -+ if (!(flags & MSG_NO_SHARED_FRAGS)) -+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; - wmem_alloc_delta += copy; - } else if (!zc) { - int i = skb_shinfo(skb)->nr_frags; -diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c -index 9f75313734f8cd..9c06c5a1419dc4 100644 ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -915,7 +915,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb) - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 7e92909ab5be3f..1f2a33fbed6e63 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1794,6 +1794,8 @@ static int __ip6_append_data(struct sock *sk, - if (err < 0) - goto error; - copy = err; -+ if (!(flags & MSG_NO_SHARED_FRAGS)) -+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; - wmem_alloc_delta += copy; - } else if (!zc) { - int i = skb_shinfo(skb)->nr_frags; diff --git a/device/main/linux-postmarketos-stable/APKBUILD b/device/main/linux-postmarketos-stable/APKBUILD index 650695808..1f386138c 100644 --- a/device/main/linux-postmarketos-stable/APKBUILD +++ b/device/main/linux-postmarketos-stable/APKBUILD @@ -1,7 +1,7 @@ # Co-Maintainer: Achill Gilgenast maintainer="Aelin " pkgname=linux-postmarketos-stable -pkgver=7.0.4 +pkgver=7.0.7 pkgrel=0 _kver=${pkgver%.*} pkgdesc="Stable Kernel" @@ -63,7 +63,6 @@ source=" 0001-WIP-arch-powerpc-boot-Support-LLVM-1-in-wrapper-scri.patch 0002-WIP-arch-powerpc-boot-Use-z-notext-for-pseries-image.patch 0003-WIP-arch-powerpc-boot-Add-z-norelro.patch - 0004-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch config-stable.aarch64 config-stable.armv7 @@ -125,17 +124,16 @@ package() { } sha512sums=" -cbabaa8a17a8ef71b764dc140155575eb2288cc25ced4b36209fd2aaeba256b35234de8507844ac7798a0c1bcd24840bea2db459d8cf0fe9e3467ddd7fe7b168 patch-7.0.4.patch.xz +a9d9d4d7349cabcb688c148f5ce777390590628ef320863363016bacd701c8c61348756ca1f869ea41da7716dd73b85ad5b9b447c7ecfadc106c428f9c597cb3 patch-7.0.7.patch.xz 8c85b708342f8f09ca25b2234b22e93b62b144a9ef919fbb21827f52fa47498e778c79db1559524dd7fb360f95b2ce174171443c1859656c281be41d2b6c5a0b linux-7.0.tar.xz 1f11df2480e9f691573283597160b4c806e492cdca4825f3acb3afb70bde43abfab487bcde1f5553b431a702a0039479d041b0ce7859970e706b5a51d2ad8fb0 0001-WIP-arch-powerpc-boot-Support-LLVM-1-in-wrapper-scri.patch 26521a9c9ea769534095dc4e306babadc8bcbaf03d7faa523c377e41ba0f742ecd0490fa27791d895f729c3ae8845297dca59b4db2475e7f078e689c447430bc 0002-WIP-arch-powerpc-boot-Use-z-notext-for-pseries-image.patch 302c20c85559fc9b3b2420ed25be1bfbb76c87f2a470e4141c32e9542cf1f5c6b3b5a7847231a3eaa0f6bc0e5942d0c1599e807175dcf5e63469704c3d6adde3 0003-WIP-arch-powerpc-boot-Add-z-norelro.patch -2adacf5b985fc7f2adec208e38974e7d0960a425f28a33218d1e52f749f2262f12b3fdad16e3f636dce00c71bff94f6a178961e2572bc0499803a786972ddffc 0004-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch -bac38afb64b40be4d0588ad8e992c383d9b2a1e515739e8b8153c6c721adac03bbe865d93b2378a5d2fbe21739551ef61a99327e374d28a771c146e05fac8044 config-stable.aarch64 -b9ad950d1ce297fab80a53dd353a0a723f5b971c629120a4fbc8ae08f5b466ae69422208f8ec5e57645af9e6efe13d3b43b13cc010bfc9c05e38bd70ed7af5a4 config-stable.armv7 -7b8cff42f803b69ec36b302992c519540ef97923bcacd4a0b30bef79279ee5b81bc553a060ae0db9527265bee9c09d3d2d5beb3122215f655691cfdd15185e7b config-stable.loongarch64 -49c365419f64bf6239b689082516e64dae0a3b546c0b7fa92ac7735a496a5809aa80443299379c3b40fabc1bcc80dc4144f92c53548ded24f837c03bb823c06c config-stable.ppc64le -60226d778dc10e03a245523b0ee0d9a65393be292dde4219128c067c80f18eaa6570976d34a4cc9fb1056c76afdab60346d517a35f05a6fd93015d54b924371f config-stable.riscv64 -3822d00da47579a49b476f228882f3326a01b905392d0eb23d092033ffec6e0cdfbff829e5ef898c24b1aaebc04998badca983be86d44907347a64e9ceaefa0c config-stable.x86 -2f4fa6fd514d23b59c6df845f71e97ac776c040e7ef01f2b66211c2bdc67ce7195c0fc9a07f7cba9a825ba1a9159e10a473fce1e789e849d51a500fb67f5d52f config-stable.x86_64 +77d7346a720c17b9517e6dbb0748ccff821ca823ff0d0632e6be188a8eeb7199cf1b0250919a5fb11e573d7f42eeeeba6519562b49778750042de7e0b2b9b55e config-stable.aarch64 +9800c7b070ab4af4be1ec146a5327abd6971b84ae1b3ab08283d2c9c508c3647259700ee749abdab017673f452ffc698159111141326366377c878b3c285836c config-stable.armv7 +372d6d667afc8b6fb6fc63f3a366a8e01d027f55ba1a0510bda5aa3cbac7955a593fba6ef4edba2434e940de0a758cb22c733c70331a91ba5e3f4281e6a73cb6 config-stable.loongarch64 +aed1f719411c65975e7587381a6c048748e06cbe9df57d6a0c756ddda699d69552ba7c50b1128aee4fe178e3982473840e59d1384dbe4eec876e1e0c7ac97f62 config-stable.ppc64le +608400864d9b2e9f73f840143be13b35c85fbd454e9cbd5c5a4516ef160d1653e7425425ca01408e5a5f33f46427926752a6f553c86ab032f698527a9798a87e config-stable.riscv64 +4a9564050bf274b926ea9370d568375a1ef1e9598015b200bbf059cbbdc9d521298857f818a3833e5ab8bc13d72bde1b278e051816fa917df481900632dd5eba config-stable.x86 +b932a8cf94ebb94c63a8a971c4cdfd9293dcf3693cc6a32e6ed347af5b90c58df2c2d3d596b6a45748ef31cb78fd3281dd11f73a8375579082d3d31560ad8fcc config-stable.x86_64 " diff --git a/device/main/linux-postmarketos-stable/config-stable.aarch64 b/device/main/linux-postmarketos-stable/config-stable.aarch64 index d93bc5427..853a61854 100644 --- a/device/main/linux-postmarketos-stable/config-stable.aarch64 +++ b/device/main/linux-postmarketos-stable/config-stable.aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 7.0.4 Kernel Configuration +# Linux/arm64 7.0.7 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3" CONFIG_GCC_VERSION=0 diff --git a/device/main/linux-postmarketos-stable/config-stable.armv7 b/device/main/linux-postmarketos-stable/config-stable.armv7 index 10702294b..960e0e4d7 100644 --- a/device/main/linux-postmarketos-stable/config-stable.armv7 +++ b/device/main/linux-postmarketos-stable/config-stable.armv7 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm 7.0.4 Kernel Configuration +# Linux/arm 7.0.7 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3" CONFIG_GCC_VERSION=0 diff --git a/device/main/linux-postmarketos-stable/config-stable.loongarch64 b/device/main/linux-postmarketos-stable/config-stable.loongarch64 index 0481fc20e..ab1ffbff0 100644 --- a/device/main/linux-postmarketos-stable/config-stable.loongarch64 +++ b/device/main/linux-postmarketos-stable/config-stable.loongarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/loongarch 7.0.4 Kernel Configuration +# Linux/loongarch 7.0.7 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3" CONFIG_GCC_VERSION=0 diff --git a/device/main/linux-postmarketos-stable/config-stable.ppc64le b/device/main/linux-postmarketos-stable/config-stable.ppc64le index 1999e73b8..ae0870574 100644 --- a/device/main/linux-postmarketos-stable/config-stable.ppc64le +++ b/device/main/linux-postmarketos-stable/config-stable.ppc64le @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/powerpc 7.0.4 Kernel Configuration +# Linux/powerpc 7.0.7 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3" CONFIG_GCC_VERSION=0 @@ -7570,7 +7570,6 @@ CONFIG_RATIONAL=y CONFIG_GENERIC_IOMAP=y CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y CONFIG_ARCH_HAS_FAST_MULTIPLIER=y -CONFIG_CRC7=m CONFIG_CRC8=m CONFIG_CRC16=y CONFIG_CRC_CCITT=m diff --git a/device/main/linux-postmarketos-stable/config-stable.riscv64 b/device/main/linux-postmarketos-stable/config-stable.riscv64 index 8760d067b..ba0a1e051 100644 --- a/device/main/linux-postmarketos-stable/config-stable.riscv64 +++ b/device/main/linux-postmarketos-stable/config-stable.riscv64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/riscv 7.0.4 Kernel Configuration +# Linux/riscv 7.0.7 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3" CONFIG_GCC_VERSION=0 diff --git a/device/main/linux-postmarketos-stable/config-stable.x86 b/device/main/linux-postmarketos-stable/config-stable.x86 index 55e1cb274..82cb5fe46 100644 --- a/device/main/linux-postmarketos-stable/config-stable.x86 +++ b/device/main/linux-postmarketos-stable/config-stable.x86 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/i386 7.0.4 Kernel Configuration +# Linux/i386 7.0.7 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3" CONFIG_GCC_VERSION=0 diff --git a/device/main/linux-postmarketos-stable/config-stable.x86_64 b/device/main/linux-postmarketos-stable/config-stable.x86_64 index 4b61ab106..c1161b371 100644 --- a/device/main/linux-postmarketos-stable/config-stable.x86_64 +++ b/device/main/linux-postmarketos-stable/config-stable.x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86_64 7.0.4 Kernel Configuration +# Linux/x86_64 7.0.7 Kernel Configuration # CONFIG_CC_VERSION_TEXT="Alpine clang version 22.1.3" CONFIG_GCC_VERSION=0