[PATCH net v3] rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Jiayuan Chen]

On 5/10/26 11:45 PM, Jakub Kicinski wrote:
> On Fri, 8 May 2026 17:53:09 +0900 Hyunwoo Kim wrote:
>>   			    sp->hdr.securityIndex != 0 &&
>> -			    skb_cloned(skb)) {
>> +			    (skb_cloned(skb) ||
>> +			     skb_has_frag_list(skb) ||
>> +			     skb_has_shared_frag(skb))) {
> We seem to be getting a lot of fixes for this issue, and this one is
> incorrect :| Writing to _any_ frags is incorrect. You have to copy
> if skb is not linear. skb_ensure_writable()


There is a issue Simon pointed [1] that triggered 
BUG_ON(skb_shared(skb)) which was fixed by commit d0d5c0cd1e71
skb_cow_data -> __pskb_pull_tail -> pskb_expand_head -> 
BUG_ON(skb_shared(skb))

I think skb_ensure_writable will also trigger such code:
skb_ensure_writable -> pskb_may_pull -> __pskb_pull_tail -> 
pskb_expand_head -> BUG_ON(skb_shared(skb))

LPE will become panic.

[1]: 
https://lore.kernel.org/netdev/20260501155806.222592-3-horms@kernel.org/