[PATCH net] net: fix frag_list leak in skb_segment_list() error path

[PATCH net] net: fix frag_list leak in skb_segment_list() error path

[Eric Dumazet]

skb_segment_list() detaches the frag_list from the head skb and moves
its members one by one to the skb->next chain. On error, err_linearize
frees that chain with kfree_skb_list(skb->next), relying on the members
not yet processed to still be linked after the current one.

This does not hold when the current member was shared: it is replaced
by skb_clone(), and __skb_clone() clears ->next. If __skb_linearize()
then fails on that clone, the remaining members are no longer reachable
from skb->next nor from skb_shinfo(skb)->frag_list, and they leak.

The skb_shared() error branch already relinks nskb->next to list_skb
before jumping to err_linearize. Do it unconditionally right after nskb
is added to the chain, so every error exit sees the remaining members.
On the last member list_skb is NULL, which still terminates the chain.

Fixes: 53475c5dd856 ("net: fix use-after-free when UDP GRO with shared fraglist")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Cc: Simon Polack <spolack+git@mailbox.org>
---
Bug discovered while reviewing at Simon Polack upcoming patch in
skb_segment_list()

 net/core/skbuff.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ab178af02a2262d65175daff7f093c85eaa09c92..beddbf6812b9f387672c7ab5f0a1c07ab9bd0806 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4734,10 +4734,13 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
 		else
 			tail->next = nskb;
 
-		if (unlikely(err)) {
-			nskb->next = list_skb;
+		/* nskb may be a clone with a NULL ->next: keep the remaining
+		 * members linked so that err_linearize frees them.
+		 */
+		nskb->next = list_skb;
+
+		if (unlikely(err))
 			goto err_linearize;
-		}
 
 		tail = nskb;
 
-- 
2.53.0

Re: [PATCH net] net: fix frag_list leak in skb_segment_list() error path

[Willem de Bruijn]

Eric Dumazet wrote:
> skb_segment_list() detaches the frag_list from the head skb and moves
> its members one by one to the skb->next chain. On error, err_linearize
> frees that chain with kfree_skb_list(skb->next), relying on the members
> not yet processed to still be linked after the current one.
> 
> This does not hold when the current member was shared: it is replaced
> by skb_clone(), and __skb_clone() clears ->next. If __skb_linearize()
> then fails on that clone, the remaining members are no longer reachable
> from skb->next nor from skb_shinfo(skb)->frag_list, and they leak.
> 
> The skb_shared() error branch already relinks nskb->next to list_skb
> before jumping to err_linearize. Do it unconditionally right after nskb
> is added to the chain, so every error exit sees the remaining members.
> On the last member list_skb is NULL, which still terminates the chain.
> 
> Fixes: 53475c5dd856 ("net: fix use-after-free when UDP GRO with shared fraglist")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> Cc: Simon Polack <spolack+git@mailbox.org>

Reviewed-by: Willem de Bruijn <willemb@google.com>

Re: [PATCH net] net: fix frag_list leak in skb_segment_list() error path

[Wang Zhan]

On Wed, 21 Oct 2026 18:18:58 +0200 Eric Dumazet wrote:
> skb_segment_list() detaches the frag_list from the head skb and moves
> its members one by one to the skb->next chain. On error, err_linearize
> frees that chain with kfree_skb_list(skb->next), relying on the members
> not yet processed to still be linked after the current one.
>
> This does not hold when the current member was shared: it is replaced
> by skb_clone(), and __skb_clone() clears ->next. If __skb_linearize()
> then fails on that clone, the remaining members are no longer reachable
> from skb->next nor from skb_shinfo(skb)->frag_list, and they leak.
>
> The skb_shared() error branch already relinks nskb->next to list_skb
> before jumping to err_linearize. Do it unconditionally right after nskb
> is added to the chain, so every error exit sees the remaining members.
> On the last member list_skb is NULL, which still terminates the chain.
>
> Fixes: 53475c5dd856 ("net: fix use-after-free when UDP GRO with shared fraglist")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> Cc: Simon Polack <spolack+git@mailbox.org>

Reviewed-by: Wang Zhan <wang.zhan@smartx.com>

Re: [PATCH net] net: fix frag_list leak in skb_segment_list() error path

[Jiayuan Chen]

On 10/22/26 12:18 AM, Eric Dumazet wrote:
> skb_segment_list() detaches the frag_list from the head skb and moves
> its members one by one to the skb->next chain. On error, err_linearize
> frees that chain with kfree_skb_list(skb->next), relying on the members
> not yet processed to still be linked after the current one.
>
> This does not hold when the current member was shared: it is replaced
> by skb_clone(), and __skb_clone() clears ->next. If __skb_linearize()
> then fails on that clone, the remaining members are no longer reachable
> from skb->next nor from skb_shinfo(skb)->frag_list, and they leak.
>
> The skb_shared() error branch already relinks nskb->next to list_skb
> before jumping to err_linearize. Do it unconditionally right after nskb
> is added to the chain, so every error exit sees the remaining members.
> On the last member list_skb is NULL, which still terminates the chain.
>
> Fixes: 53475c5dd856 ("net: fix use-after-free when UDP GRO with shared fraglist")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> Cc: Simon Polack <spolack+git@mailbox.org>



Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>


> ---
> Bug discovered while reviewing at Simon Polack upcoming patch in
> skb_segment_list()
>
>   net/core/skbuff.c | 9 ++++++---
>   1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index ab178af02a2262d65175daff7f093c85eaa09c92..beddbf6812b9f387672c7ab5f0a1c07ab9bd0806 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -4734,10 +4734,13 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
>   		else
>   			tail->next = nskb;
>   
> -		if (unlikely(err)) {
> -			nskb->next = list_skb;
> +		/* nskb may be a clone with a NULL ->next: keep the remaining
> +		 * members linked so that err_linearize frees them.
> +		 */
> +		nskb->next = list_skb;
> +
> +		if (unlikely(err))
>   			goto err_linearize;
> -		}
>   
>   		tail = nskb;
>   

Re: [PATCH net] net: fix frag_list leak in skb_segment_list() error path

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 21 Oct 2026 18:18:58 +0200 you wrote:
> skb_segment_list() detaches the frag_list from the head skb and moves
> its members one by one to the skb->next chain. On error, err_linearize
> frees that chain with kfree_skb_list(skb->next), relying on the members
> not yet processed to still be linked after the current one.
> 
> This does not hold when the current member was shared: it is replaced
> by skb_clone(), and __skb_clone() clears ->next. If __skb_linearize()
> then fails on that clone, the remaining members are no longer reachable
> from skb->next nor from skb_shinfo(skb)->frag_list, and they leak.
> 
> [...]

Here is the summary with links:
  - [net] net: fix frag_list leak in skb_segment_list() error path
    https://git.kernel.org/netdev/net/c/546daf344420

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html