[PATCH net v1 1/2] net: core: check skb_frags_readable before uncloning in skb_copy_ubufs

[PATCH net v1 1/2] net: core: check skb_frags_readable before uncloning in skb_copy_ubufs

[Mina Almasry]

skb_copy_ubufs drops clones and modifies the SKB via pskb_expand_head()
before checking for !skb_frags_readable(skb). This alters the SKB
geometry prior to throwing an -EFAULT on an invalid SKB. Check
readability first.

Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags")

Signed-off-by: Mina Almasry <almasrymina@google.com>
---
Note to sashiko: if you find pre-existing issues, mark them clearly as pre-existing.
---
 net/core/skbuff.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d4382b68d56e0..201c9ec1519c7 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2001,12 +2001,12 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
 	int i, order, psize, new_frags;
 	u32 d_off;
 
-	if (skb_shared(skb) || skb_unclone(skb, gfp_mask))
-		return -EINVAL;
-
 	if (!skb_frags_readable(skb))
 		return -EFAULT;
 
+	if (skb_shared(skb) || skb_unclone(skb, gfp_mask))
+		return -EINVAL;
+
 	if (!num_frags)
 		goto release;
 

base-commit: 7cbfb180945ce529608e4d4e24a6d483699fab1e
-- 
2.55.0.766.g2966f0265a-goog

[PATCH net v1 2/2] net: core: fix head-page leak in skb_zerocopy

[Mina Almasry]

When skb_orphan_frags() throws -ENOMEM, skb_copy_ubufs() may have
already reallocated and replaced 'from->head'. Accessing from->head to
drop the old refcount leaks the original head page, and erroneously
puts an unrelated new buffer. Use the local 'page' tracker variable
instead to drop the reference properly.

Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors")

Signed-off-by: Mina Almasry <almasrymina@google.com>
---
Note to sashiko: if you find pre-existing issues, mark them clearly as pre-existing.
---
 net/core/skbuff.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 201c9ec1519c7..92aad6f0b0e14 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3907,7 +3907,7 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 	}
 
 	if (!skb_frags_readable(from) && j > 0 && len) {
-		put_page(virt_to_head_page(from->head));
+		put_page(page);
 		return -EFAULT;
 	}
 
@@ -3916,7 +3916,7 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 	if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
 		skb_tx_error(from);
 		if (j > 0)
-			put_page(virt_to_head_page(from->head));
+			put_page(page);
 		return -ENOMEM;
 	}
 	skb_zerocopy_clone(to, from, GFP_ATOMIC);
-- 
2.55.0.766.g2966f0265a-goog

Re: [PATCH net v1 2/2] net: core: fix head-page leak in skb_zerocopy

[Paolo Abeni]

On 8/23/26 8:36 PM, Mina Almasry wrote:
> When skb_orphan_frags() throws -ENOMEM, skb_copy_ubufs() may have
> already reallocated and replaced 'from->head'. Accessing from->head to
> drop the old refcount leaks the original head page, and erroneously
> puts an unrelated new buffer. Use the local 'page' tracker variable
> instead to drop the reference properly.
> 
> Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors")
> 
> Signed-off-by: Mina Almasry <almasrymina@google.com>
Note that there must be no empty lines in the tag area; no need to
repost, I'll fix it while applying.

/P

Re: [PATCH net v1 1/2] net: core: check skb_frags_readable before uncloning in skb_copy_ubufs

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Sun, 23 Aug 2026 18:36:01 +0000 you wrote:
> skb_copy_ubufs drops clones and modifies the SKB via pskb_expand_head()
> before checking for !skb_frags_readable(skb). This alters the SKB
> geometry prior to throwing an -EFAULT on an invalid SKB. Check
> readability first.
> 
> Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags")
> 
> [...]

Here is the summary with links:
  - [net,v1,1/2] net: core: check skb_frags_readable before uncloning in skb_copy_ubufs
    https://git.kernel.org/netdev/net/c/00e11ee9831b
  - [net,v1,2/2] net: core: fix head-page leak in skb_zerocopy
    https://git.kernel.org/netdev/net/c/97148bcb7511

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html