Linux kernel (net/xfrm): A peer that mixes zero-copy-eligible and copy-path IPTFS fragments in one datagram makes

Impact

A peer that mixes zero-copy-eligible and copy-path IPTFS fragments in one datagram makes reassembly call skb_put() on an already non-linear buffer, hitting SKB_LINEAR_ASSERT and taking an invalid-opcode fault in NAPI softirq. That is a hard kernel panic driven by packet shape - every tenant on the node loses its GPUs, and the sender can repeat it after each reboot.

Who can reach it

Inbound ESP on an IPTFS SA; the fragment sequence is chosen by the sender, so any peer holding the SA reaches it - a peer node, a compromised node, or the far side of a tenant overlay tunnel. The published call trace runs straight from the NIC driver's NAPI poll through xfrm4_esp_rcv into iptfs_reassem_cont, so no local access or tenant device node is involved. Conditional on IPTFS mode being configured.

What to do

Boot a kernel carrying the fix commits below (no fixed stable version published). Interim control: disable IP-TFS mode on SAs that terminate traffic from tenants or from nodes you do not fully trust.

References