[PATCH net-next v3] net: skb: isolate skb data area allocations into a separate bucket

[PATCH net-next v3] net: skb: isolate skb data area allocations into a separate bucket

[Pedro Falcato]

SKB data area allocations (as done from alloc_skb()) use kmalloc().
These allocations can be variably sized and their contents can be more
or less controlled from userspace, which makes them useful for attackers
that want to overwrite a use-after-free'd object from the same kmalloc slab
(which often just requires the sizes to roughly match into the same kmalloc
bucket). [0] is an easy example of an exploit that uses netlink skb
allocation to target another similarly-sized accidentally freed object.

While other mitigations like CONFIG_RANDOM_KMALLOC_CACHES exist, these are
probabilistic. Use the existing kmem buckets API to further isolate these
allocations in a guaranteed fashion, when CONFIG_SLAB_BUCKETS=y.

Link: https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4207_lts_cos_mitigation_2/docs/exploit.md [0]
Reviewed-by: Kees Cook <kees@kernel.org>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Pedro Falcato <pfalcato@suse.de>
---
v3:
 - rebase on net-next and resend

 net/core/skbuff.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 18dabb4e9cfa..9dc5a8548681 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -586,6 +586,8 @@ struct sk_buff *napi_build_skb(void *data, unsigned int frag_size)
 }
 EXPORT_SYMBOL(napi_build_skb);
 
+static kmem_buckets *skb_data_buckets __ro_after_init;
+
 static void *kmalloc_pfmemalloc(size_t obj_size, gfp_t flags, int node)
 {
 	if (!gfp_pfmemalloc_allowed(flags))
@@ -593,7 +595,8 @@ static void *kmalloc_pfmemalloc(size_t obj_size, gfp_t flags, int node)
 	if (!obj_size)
 		return kmem_cache_alloc_node(net_hotdata.skb_small_head_cache,
 					     flags, node);
-	return kmalloc_node_track_caller(obj_size, flags, node);
+	return kmem_buckets_alloc_node_track_caller(skb_data_buckets, obj_size,
+						    flags, node);
 }
 
 /*
@@ -634,7 +637,7 @@ static void *kmalloc_reserve(unsigned int *size, gfp_t flags, int node,
 	 * Try a regular allocation, when that fails and we're not entitled
 	 * to the reserves, fail.
 	 */
-	obj = kmalloc_node_track_caller(obj_size,
+	obj = kmem_buckets_alloc_node_track_caller(skb_data_buckets, obj_size,
 					flags | __GFP_NOMEMALLOC | __GFP_NOWARN,
 					node);
 	if (likely(obj))
@@ -5215,6 +5218,7 @@ void __init skb_init(void)
 						0,
 						SKB_SMALL_HEAD_HEADROOM,
 						NULL);
+	skb_data_buckets = kmem_buckets_create("skb_data", SLAB_PANIC, 0, INT_MAX, NULL);
 	skb_extensions_init();
 }
 
-- 
2.54.0

Re: [PATCH net-next v3] net: skb: isolate skb data area allocations into a separate bucket

[Paolo Abeni]

On 7/2/26 7:07 PM, Pedro Falcato wrote:> @@ -586,6 +586,8 @@ struct
sk_buff *napi_build_skb(void *data, unsigned int frag_size)
>  }
>  EXPORT_SYMBOL(napi_build_skb);
>  
> +static kmem_buckets *skb_data_buckets __ro_after_init;
> +
>  static void *kmalloc_pfmemalloc(size_t obj_size, gfp_t flags, int node)
>  {
>  	if (!gfp_pfmemalloc_allowed(flags))
> @@ -593,7 +595,8 @@ static void *kmalloc_pfmemalloc(size_t obj_size, gfp_t flags, int node)
>  	if (!obj_size)
>  		return kmem_cache_alloc_node(net_hotdata.skb_small_head_cache,
>  					     flags, node);
> -	return kmalloc_node_track_caller(obj_size, flags, node);
> +	return kmem_buckets_alloc_node_track_caller(skb_data_buckets, obj_size,
> +						    flags, node);

Sashiko noted that some drivers may require GFP_DMA buckets, and the
above may break them:

https://sashiko.dev/#/patchset/20260702170728.168755-1-pfalcato%40suse.de

>  }
>  
>  /*
> @@ -634,7 +637,7 @@ static void *kmalloc_reserve(unsigned int *size, gfp_t flags, int node,
>  	 * Try a regular allocation, when that fails and we're not entitled
>  	 * to the reserves, fail.
>  	 */
> -	obj = kmalloc_node_track_caller(obj_size,
> +	obj = kmem_buckets_alloc_node_track_caller(skb_data_buckets, obj_size,
>  					flags | __GFP_NOMEMALLOC | __GFP_NOWARN,
>  					node);

Minor nit: checkpatch laments WRT brackets alignment.

/P

Re: [PATCH net-next v3] net: skb: isolate skb data area allocations into a separate bucket

[Pedro Falcato]

On Wed, Jul 08, 2026 at 10:30:50AM +0200, Paolo Abeni wrote:
> On 7/2/26 7:07 PM, Pedro Falcato wrote:> @@ -586,6 +586,8 @@ struct
> sk_buff *napi_build_skb(void *data, unsigned int frag_size)
> >  }
> >  EXPORT_SYMBOL(napi_build_skb);
> >  
> > +static kmem_buckets *skb_data_buckets __ro_after_init;
> > +
> >  static void *kmalloc_pfmemalloc(size_t obj_size, gfp_t flags, int node)
> >  {
> >  	if (!gfp_pfmemalloc_allowed(flags))
> > @@ -593,7 +595,8 @@ static void *kmalloc_pfmemalloc(size_t obj_size, gfp_t flags, int node)
> >  	if (!obj_size)
> >  		return kmem_cache_alloc_node(net_hotdata.skb_small_head_cache,
> >  					     flags, node);
> > -	return kmalloc_node_track_caller(obj_size, flags, node);
> > +	return kmem_buckets_alloc_node_track_caller(skb_data_buckets, obj_size,
> > +						    flags, node);
> 
> Sashiko noted that some drivers may require GFP_DMA buckets, and the
> above may break them:
> 
> https://sashiko.dev/#/patchset/20260702170728.168755-1-pfalcato%40suse.de

Oh, this is really awkward. Adding linux-mm and slab maintainers for input here.

Considering the current slab bucketing does not seem to duplicate DMA or
CGROUP caches, could it make sense to duplicate those as well? Otherwise we
could add a branch like:

if (gfp_flags & __GFP_DMA)
	/* use the global dma kmalloc caches */

> 
> >  }
> >  
> >  /*
> > @@ -634,7 +637,7 @@ static void *kmalloc_reserve(unsigned int *size, gfp_t flags, int node,
> >  	 * Try a regular allocation, when that fails and we're not entitled
> >  	 * to the reserves, fail.
> >  	 */
> > -	obj = kmalloc_node_track_caller(obj_size,
> > +	obj = kmem_buckets_alloc_node_track_caller(skb_data_buckets, obj_size,
> >  					flags | __GFP_NOMEMALLOC | __GFP_NOWARN,
> >  					node);
> 
> Minor nit: checkpatch laments WRT brackets alignment.

Will fix, thanks.

-- 
Pedro

Re: [PATCH net-next v3] net: skb: isolate skb data area allocations into a separate bucket

[Harry Yoo]

On 7/8/26 8:16 PM, Pedro Falcato wrote:
> On Wed, Jul 08, 2026 at 10:30:50AM +0200, Paolo Abeni wrote:
>> On 7/2/26 7:07 PM, Pedro Falcato wrote:> @@ -586,6 +586,8 @@ struct
>> sk_buff *napi_build_skb(void *data, unsigned int frag_size)
>>>  }
>>>  EXPORT_SYMBOL(napi_build_skb);
>>>  
>>> +static kmem_buckets *skb_data_buckets __ro_after_init;
>>> +
>>>  static void *kmalloc_pfmemalloc(size_t obj_size, gfp_t flags, int node)
>>>  {
>>>  	if (!gfp_pfmemalloc_allowed(flags))
>>> @@ -593,7 +595,8 @@ static void *kmalloc_pfmemalloc(size_t obj_size, gfp_t flags, int node)
>>>  	if (!obj_size)
>>>  		return kmem_cache_alloc_node(net_hotdata.skb_small_head_cache,
>>>  					     flags, node);
>>> -	return kmalloc_node_track_caller(obj_size, flags, node);
>>> +	return kmem_buckets_alloc_node_track_caller(skb_data_buckets, obj_size,
>>> +						    flags, node);
>>
>> Sashiko noted that some drivers may require GFP_DMA buckets, and the
>> above may break them:
>>
>> https://sashiko.dev/#/patchset/20260702170728.168755-1-pfalcato%40suse.de
> 
> Oh, this is really awkward. Adding linux-mm and slab maintainers for input here.
> 
> Considering the current slab bucketing does not seem to duplicate DMA or
> CGROUP caches, could it make sense to duplicate those as well?

Could we specify what kmalloc types the user needs when creating
kmem_buckets and duplicate caches for the requested kmalloc types only?

> Otherwise we could add a branch like:
>
> if (gfp_flags & __GFP_DMA)
> 	/* use the global dma kmalloc caches */

-- 
Cheers,
Harry / Hyeonggon