From 1e6d45378b272fe2f1fce48ed89d6eaa415c00c2 Mon Sep 17 00:00:00 2001
From: Jingguo Tan <tanjingguo@huawei.com>
Date: Mon, 18 May 2026 17:06:48 +0800
Subject: [PATCH ipsec v2] xfrm: esp: restore combined single-frag length gate

The ESP out-of-place fast path appends the trailer in esp_output_head()
before esp_output_tail() allocates the destination page frag. The
head-side gate currently checks skb->data_len and tailen separately, but
the tail code allocates a single destination frag from the combined
post-trailer skb->data_len.

Reject the page-frag fast path when the combined aligned length exceeds a
page. Otherwise skb_page_frag_refill() may fall back to a single page while
the destination sg still spans the combined skb->data_len.

Restore this combined-length page gate for both IPv4 and IPv6.

Fixes: 5bd8baab087d ("esp: limit skb_page_frag_refill use to a single page")
Cc: stable@vger.kernel.org
Signed-off-by: Lin Ma <malin89@huawei.com>
Signed-off-by: Chenyuan Mi <michenyuan@huawei.com>
Signed-off-by: Jingguo Tan <tanjingguo@huawei.com>
---
Changes in v2:
  - Use the ipsec tree subject prefix.
  - Clarify that esp_output_tail() allocates after esp_output_head() appends
    tailen.
  - Avoid shadowing the existing allocsize variable.
  - v1: https://lore.kernel.org/netdev/ag7kxJ39XQaVY1Mb@krikkit/T/#t

 net/ipv4/esp4.c | 4 ++--
 net/ipv6/esp6.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 6a5febbdbee49..c62dfe049ee7 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -419,8 +419,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
 			return err;
 	}
 
-	if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
-	    ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+	if (ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) >
+	    PAGE_SIZE)
 		goto cow;
 
 	if (!skb_cloned(skb)) {
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 9c06c5a1419dc..2516a4dc6d78 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -448,8 +448,8 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
 			return err;
 	}
 
-	if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
-	    ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+	if (ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) >
+	    PAGE_SIZE)
 		goto cow;
 
 	if (!skb_cloned(skb)) {
-- 
2.43.0

Note that you must respect a 24-hour delay between reposts of the same
patch:
https://docs.kernel.org/process/maintainer-netdev.html#tl-dr

2026-05-21, 12:00:55 +0000, tanjingguo wrote:
> Changes in v2:
>   - Use the ipsec tree subject prefix.
>   - Clarify that esp_output_tail() allocates after esp_output_head() appends
>     tailen.

Thanks for the clarification.

>   - Avoid shadowing the existing allocsize variable.
>   - v1: https://lore.kernel.org/netdev/ag7kxJ39XQaVY1Mb@krikkit/T/#t
> 
>  net/ipv4/esp4.c | 4 ++--
>  net/ipv6/esp6.c | 4 ++--
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
> index 6a5febbdbee49..c62dfe049ee7 100644
> --- a/net/ipv4/esp4.c
> +++ b/net/ipv4/esp4.c
> @@ -419,8 +419,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
>  			return err;
>  	}
>  
> -	if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
> -	    ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
> +	if (ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) >
> +	    PAGE_SIZE)
>  		goto cow;

nit: you didn't need to wrap here, the total length of this line is
under 80 columns.

But other than that, the fix looks correct to me:
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>

I don't know if Steffen will require a repost or apply this directly,
so please wait at least the standard 24 hours.

Thanks,

-- 
Sabrina