From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8593C377ECA for ; Sun, 23 Aug 2026 18:36:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.197 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787510165; cv=none; b=LDqKEtK6qsHHhqi7pPLlIHwdf3b8iyxSKbBzhpbNglV6+g6gyxt5fwxMTMsUT5pL8jjMMb/hFPA0nm/zS884CaUP3P0vm4V37/3t+QmXxX40pI8XN5pBo5Tw7JefxqhwdX0kpbtLcGocSWI5QzFEQJXGVqG6/yVsAqz0UJzUxn4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787510165; c=relaxed/simple; bh=gscrcobiFZjTV8CWh53O8e36+ERF3+9AvCKc+SjayGE=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=n+FGzl5EdGRJDQwxzIFIZ5mWvZySCcWiZZ+IYR4SmoLSt+v7oe9MIbDuyJAdKWrksRWk7DL7ox86hICqNqI4LPAo8eM9leKgOClwvKsFhoCe4a3rcEC1xPPiaiC9smq0gcs+PD1YIDydLguVC8038B3RvdMAptT+lePooHnqQRQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=TCjZXzmt; arc=none smtp.client-ip=209.85.210.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="TCjZXzmt" Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-848d21bbb55so4204432b3a.0 for ; Sun, 23 Aug 2026 11:36:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787510164; x=1788114964; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=2UUizFyvTXfnDZkThaHs02zvim1q/J5mzBIkFP4tM+c=; b=TCjZXzmtmOU36XVBrEpFFhsEMJMjd5to8BAfJAVU+j5kptVcXqo+Q9QCj3Efa+twCU n/gpjTy6DxkfMur2ZHm8ufEjtPLTG6f1dmd7e8gVuJaN9iq+sLUrL6w8pw/HU/NJQKnf Iy23VMiycz+3L0im6wAYlsfeD7x+DqX9cnmLDIwsJQfjTq33rACeE+ljkE76J+VcyNWU qSdTZ5Vi1ZjircucKH1vOjyU4CM98LaE2l8wUkVcBWtlAz38LKQSi3uzH5gy8x4fNAf4 +VhKhrvg/heqtmhvkH6T3pxFQcbF/LnTZXSBHqHybq0Eobmrr7uXaHoNBSVWkCMOd7ga FwlQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787510164; x=1788114964; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2UUizFyvTXfnDZkThaHs02zvim1q/J5mzBIkFP4tM+c=; b=DTeTQAfTw3tBBKGLPx+Y7aNlawzyobCSQccS9qtMBz/jzJ4idWzLc2xyqSm1aCUtL4 CDXc2p4H+VLu40J/zJGDvmlQuK/1sJqfCCogZjgJBL2LIpsrIV07Shqk3YIP5+iXPcEp Fi4lprcpQZQyfpxwsQAwBpnIwnoI1watfABblkv4qIEQcEQdnGceS1tiXkPEqKebLc74 3lr0ZnRYyMOlWbSY60nYLNxKzlCQ+L5dAsyoyl/sYCzf87VzuZDVs6nuYZrScPJXQhWd Eacs2TMZE/Dx44g0dBhPy45RQ3vydqpPp/9nHXDFUaf2Z3/H4HsOb15PfTAajNNgixdr cuNA== X-Forwarded-Encrypted: i=1; AHgh+RqcYtageehL8sberoL7L29fR1c1VQBDRWSrM5pWWG5bJBtiaMQtXBE2wLIH/Mv1KD4EwfB1vxQ8lbh7/a0=@vger.kernel.org X-Gm-Message-State: AFuF++ktXQpaNzj7a3mMeRQBUjvqrVCC6CaGW5JMlLCj2UTrPnDyJPyh v/BDIfXlfR/5veIQQZpO9+WM2GEEGb/lnUeuVsDaiCTniMxskXs1rMYTyPQlxsJP388CUGdknxm 9HglrvrZCVqKxvLBS4ozM+g3CMA== X-Received: from dlbbz30.prod.google.com ([2002:a05:7022:239e:b0:13e:5cad:4689]) (user=almasrymina job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:c90c:b0:3cc:22bb:8911 with SMTP id adf61e73a8af0-3cd2fe7a2cdmr41465461637.6.1787510163813; Sun, 23 Aug 2026 11:36:03 -0700 (PDT) Date: Sun, 23 Aug 2026 18:36:02 +0000 In-Reply-To: <20260823183602.1051453-1-almasrymina@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260823183602.1051453-1-almasrymina@google.com> X-Mailer: git-send-email 2.55.0.766.g2966f0265a-goog Message-ID: <20260823183602.1051453-2-almasrymina@google.com> Subject: [PATCH net v1 2/2] net: core: fix head-page leak in skb_zerocopy From: Mina Almasry To: Jakub Kicinski , Kaiyuan Zhang , Willem de Bruijn , Mina Almasry , Eric Dumazet , Zoltan Kiss , "David S. Miller" , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Paolo Abeni , Simon Horman , Jason Xing Content-Type: text/plain; charset="UTF-8" When skb_orphan_frags() throws -ENOMEM, skb_copy_ubufs() may have already reallocated and replaced 'from->head'. Accessing from->head to drop the old refcount leaks the original head page, and erroneously puts an unrelated new buffer. Use the local 'page' tracker variable instead to drop the reference properly. Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors") Signed-off-by: Mina Almasry --- Note to sashiko: if you find pre-existing issues, mark them clearly as pre-existing. --- net/core/skbuff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 201c9ec1519c7..92aad6f0b0e14 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3907,7 +3907,7 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) } if (!skb_frags_readable(from) && j > 0 && len) { - put_page(virt_to_head_page(from->head)); + put_page(page); return -EFAULT; } @@ -3916,7 +3916,7 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) { skb_tx_error(from); if (j > 0) - put_page(virt_to_head_page(from->head)); + put_page(page); return -ENOMEM; } skb_zerocopy_clone(to, from, GFP_ATOMIC); -- 2.55.0.766.g2966f0265a-goog