Re: [PATCH net] net: gro: don't copy frags between mixed zcopy skbs

[Sabrina Dubroca <sd@queasysnail.net>]

2026-05-19, 15:39:19 +0100, Pavel Begunkov wrote:
> On 5/19/26 13:40, Sabrina Dubroca wrote:
> > skb_gro_receive() can currently copy frags between the source and GRO
> > skb, without checking the zerocopy status, and in particular the
> > SKBFL_MANAGED_FRAG_REFS flag.
> > 
> > When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference
> > on the pages in shinfo->frags. Appending those frags to another skb's
> > frags without fixing up the page refcount can lead to UAF.
> > 
> > When either the last skb in the GRO chain (the one we would append
> > frags to) or the source skb is zerocopy, skip the frags copy, and just
> > append the new skb to the frag_list.
> 
> Was it reproduced? Sounds like we're missing skb_orphan_frags_rx()
> as skbs looping into rx should be orphaned.
> 
> +cc Willem

Yes, as I wrote in the patch:

Huzaifa has found this to be exploitable to overwrite the page cache

Neither of us is that familiar with MANAGED_FRAG_REFS/iouring, so
maybe there's a better way to fix this at another location in the
stack.

-- 
Sabrina