# \[PATCH net v3 1/3\] net: hsr: privatize interlink-bound skbs before address mutation - From: Xin Xie \ - Date: 2026-08-08 00:45:32 - List: netdev - Page: https://ratatoskr.run/netdev/2026/08/17385632 - Thread: https://ratatoskr.run/netdev/2026/08/17385631/t.md ```text An skb sent to a RedBox interlink can share data with master delivery or the original TX skb. hsr_deliver_master() and hsr_xmit() then write different source addresses, so one consumer can observe the other's address. Use skb_cow() before interlink address substitution when those paths can share the data. Drop that egress on COW failure. Other interlink traffic keeps its zero-copy behavior. Fixes: 5055cccfc2d1 ("net: hsr: Provide RedBox support (HSR-SAN)") Reviewed-by: Ali Ahmet Memis Tested-by: Ali Ahmet Memis Signed-off-by: Xin Xie --- net/hsr/hsr_forward.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c index 0774981a65c1..67aaf5a8622b 100644 --- a/net/hsr/hsr_forward.c +++ b/net/hsr/hsr_forward.c @@ -420,6 +420,22 @@ static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev, static int hsr_xmit(struct sk_buff *skb, struct hsr_port *port, struct hsr_frame_info *frame) { + /* An interlink-bound skb from get_untagged_frame() can still alias + * another live consumer: for master-originated frames the clone + * shares the original TX skb (which taps or the TX path may still + * hold); for ring frames the master also consumes them when they + * are destined to the local node without being exclusive to it. + * Privatize before any address mutation. + */ + if (port->type == HSR_PT_INTERLINK && + (frame->port_rcv->type == HSR_PT_MASTER || + (frame->is_local_dest && !frame->is_local_exclusive)) && + skb_cow(skb, 0)) { + frame->port_rcv->dev->stats.rx_dropped++; + kfree_skb(skb); + return NET_XMIT_DROP; + } + if (frame->port_rcv->type == HSR_PT_MASTER) { hsr_addr_subst_dest(frame->node_src, skb, port); -- 2.43.0 ```