[PATCH net] loopback: orphan zerocopy frags before releasing the sender in loopback_xmit()

[Bjoern Doebel <doebel@amazon.de>]

AF_PACKET PACKET_TX_RING transmission over the loopback interface can
silently corrupt packet payloads in flight. tpacket_fill_skb() builds
the transmit skb using zerocopy frags. loopback_xmit() then calls bare
skb_orphan(), which runs skb->destructor (tpacket_destruct_skb()) and
marks the ring slot TP_STATUS_AVAILABLE, telling userspace the buffer is
reusable while the in-flight skb frags still reference that buffer.

This is ok if the packet gets processed immediately in loopback's xmit
path before userspace gets a chance to reuse the frag buffer. However,
if the packet gets redirected for instance to another CPU (via RPS),
this opens a window where userspace may already write new data into the
frag buffer before the receiver reads the original content.

Reproducer using txring_overwrite from the net:run_afpackettests selftest:

  ip netns add ns && ip -netns ns link set lo up
  ip netns exec ns sh -c \
      'echo 100 > /sys/class/net/lo/queues/rx-0/rps_cpus'
  taskset -c 0 ip netns exec ns ./txring_overwrite

Commit 5cd8d46ea156 ("packet: copy user buffers before orphan or clone")
is meant to trigger this copy from the skb_orphan_frags{_rx}() call
sites, but loopback_xmit() calls bare skb_orphan() before any of them
run. Address this by taking a kernel-private copy of the skb frags
before going down the receive path.

Fixes: 5cd8d46ea156 ("packet: copy user buffers before orphan or clone")
Cc: stable@vger.kernel.org
Signed-off-by: Bjoern Doebel <doebel@amazon.de>
Assisted-by: Kiro:claude-opus-5
---
Verified that the reproducer in the commit message fails 100% right now
and no longer fails after the patch.
---
 drivers/net/loopback.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 1fb6ce6843ade..31ae10a9d7911 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -72,6 +72,23 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
 {
 	int len;
 
+	/* The skb_orphan() below will run the skb's destructor, which
+	 * for AF_PACKET TX-ring senders marks the slot as TP_STATUS_AVAILABLE
+	 * again, even though it still has zerocopy frags pointing to it that
+	 * will only be copied later in the receive path's
+	 * skb_orphan_frags_rx(). As such, if the receive path gets deferred,
+	 * for example by RPS steering the packet to another CPU, this creates
+	 * a race where userspace may fill in new data into the frag before the
+	 * old data gets copied out.
+	 *
+	 * Take a kernel-private copy.
+	 */
+	if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC))) {
+		dev_core_stats_tx_dropped_inc(dev);
+		kfree_skb_reason(skb, SKB_DROP_REASON_SKB_UCOPY_FAULT);
+		return NETDEV_TX_OK;
+	}
+
 	skb_tx_timestamp(skb);
 
 	/* do not fool net_timestamp_check() with various clock bases */
-- 
2.50.1