rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

cve CVE-2026-43500
commit-author Hyunwoo Kim <imv4bel@gmail.com>
commit -
commit-source https://lore.kernel.org/all/af2kdW2F1gJ9U-Gg@v4bel
upstream-diff |
        The conn_event.c hunk is dropped entirely. Upstream wraps the
        conn->security->verify_response() call inside a new
        rxrpc_verify_response() function that copies non-linear skbs before
        in-place decryption. This kernel doesn't have that wrapper; the
        security op is called directly from rxrpc_process_event(), so there
        is no call site to patch. Additionally, the rxkad_verify_response()
        implementation in this tree already pulls the response and ticket
        out via skb_copy_bits() into kmalloc'd local buffers and decrypts
        those buffers (not the skb backing pages), so the RESPONSE-packet
        vector that v3 closes upstream is not reachable here. The
        call_event.c hunk applies as-is.

The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true.  An skb
that is not cloned but still carries externally-owned paged fragments
(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
__ip_append_data, or a chained skb_has_frag_list()) falls through to
the in-place decryption path, which binds the frag pages directly into
the AEAD/skcipher SGL via skb_to_sgvec().

Extend the gate to also unshare when skb_has_frag_list() or
skb_has_shared_frag() is true.  This catches the splice-loopback vector
and other externally-shared frag sources while preserving the
zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
page_pool RX, GRO).  The OOM/trace handling already in place is reused.

Fixes: d0d5c0c ("rxrpc: Use skb_unshare() rather than skb_cow_data()")
	Cc: stable@vger.kernel.org
	Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
(cherry picked from commit 544687651fe57721c5e4e76380ed8ef8fdfdc98b)
	Signed-off-by: Shreeya Patel <spatel@ciq.com>

Author: V4bel

net/rxrpc/call_event.c

@@ -334,7 +334,9 @@ bool rxrpc_input_call_event(struct rxrpc_call *call)
 
 			if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
 			    sp->hdr.securityIndex != 0 &&
-			    skb_cloned(skb)) {
+			    (skb_cloned(skb) ||
+			     skb_has_frag_list(skb) ||
+			     skb_has_shared_frag(skb))) {
 				/* Unshare the packet so that it can be
 				 * modified by in-place decryption.
 				 */