From dc194b8f6275f55d812e316dcb55cd8f57056cf1 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 23 May 2026 19:54:51 +0200 Subject: Kernel: T8919: Update Linux Kernel to 6.18.33 The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability --- ...preserve-shared-frag-marker-during-coales.patch | 53 ---------------------- 1 file changed, 53 deletions(-) delete mode 100644 scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch (limited to 'scripts/package-build/linux-kernel') diff --git a/scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch b/scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch deleted file mode 100644 index b2a4f9be..00000000 --- a/scripts/package-build/linux-kernel/patches/kernel/0004-net-skbuff-preserve-shared-frag-marker-during-coales.patch +++ /dev/null @@ -1,53 +0,0 @@ -Message-ID: <20260513041635.1289541-1-vakzz@zellic.io> -Date: Wed, 13 May 2026 04:16:35 +0000 -From: William Bowling -To: netdev@...r.kernel.org -Cc: "David S . Miller" , - Eric Dumazet , - Jakub Kicinski , - Paolo Abeni , - Steffen Klassert , - Herbert Xu , - David Ahern , - William Bowling -Subject: [PATCH] net: skbuff: preserve shared-frag marker during coalescing - -skb_try_coalesce() can attach paged frags from @from to @to. If @from -has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same -externally-owned or page-cache-backed frags, but the shared-frag marker -is currently lost. - -That breaks the invariant relied on by later in-place writers. In -particular, ESP input checks skb_has_shared_frag() before deciding -whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP -receive coalescing has moved shared frags into an unmarked skb, ESP can -see skb_has_shared_frag() as false and decrypt in place over page-cache -backed frags. - -Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged -frags. The tailroom copy path does not need the marker because it copies -bytes into @to's linear data rather than transferring frag descriptors. - -Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") -Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") -Signed-off-by: William Bowling ---- - net/core/skbuff.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index a4695882d1c4..3e8f0b8226ca 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -6149,6 +6149,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, - from_shinfo->frags, - from_shinfo->nr_frags * sizeof(skb_frag_t)); - to_shinfo->nr_frags += from_shinfo->nr_frags; -+ if (from_shinfo->nr_frags) -+ to_shinfo->flags |= from_shinfo->flags & SKBFL_SHARED_FRAG; - - if (!skb_cloned(from)) - from_shinfo->nr_frags = 0; --- -2.39.5 - -- cgit v1.2.3