[PATCH v2 net] net: skbuff: propagate shared-frag marker in skb_zerocopy()

[PATCH v2 net] net: skbuff: propagate shared-frag marker in skb_zerocopy()

[Zizhen Liu]

skb_zerocopy() moves frag descriptors from @from into @to and takes a
reference on each frag, but it does not copy skb_shinfo(from)->flags into
skb_shinfo(to)->flags.  A destination skb holding the same page-cache
backed frags as the source therefore reports skb_has_shared_frag() as
false.

That breaks the invariant relied on by later in-place writers.  ESP input
checks skb_has_shared_frag() before deciding whether an uncloned
nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that
skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is
decrypted in place, letting an unprivileged user write into the page
cache of a root-owned read-only file.

Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for
the other frag-transfer helpers.

Fixes: af2806f8f90a ("net: Export skb_zerocopy() to zerocopy from one skb to another")
Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags")
Cc: stable@kernel.org
Signed-off-by: Zizhen Liu <pointerliu@126.com>
---

v2:
 - correct the first Fixes tag to af2806f8f90a, which introduced
   skb_zerocopy(); the function did not exist when cef401de7be8 was merged.

 net/core/skbuff.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 41beaf625..2bfabde31 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3942,6 +3942,8 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 	}
 	skb_shinfo(to)->nr_frags = j;
 
+	skb_shinfo(to)->flags |= skb_shinfo(from)->flags & SKBFL_SHARED_FRAG;
+
 	if (i > 0 && from->unreadable)
 		to->unreadable = 1;
 
-- 
2.43.0

Re: [PATCH v2 net] net: skbuff: propagate shared-frag marker in skb_zerocopy()

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH v2 net] net: skbuff: propagate shared-frag marker in skb_zerocopy()

[Eric Dumazet]

Le jeu. 22 oct. 2026 à 12:43, Zizhen Liu <pointerliu@126.com> a écrit :
>
> skb_zerocopy() moves frag descriptors from @from into @to and takes a
> reference on each frag, but it does not copy skb_shinfo(from)->flags into
> skb_shinfo(to)->flags.  A destination skb holding the same page-cache
> backed frags as the source therefore reports skb_has_shared_frag() as
> false.
>
> That breaks the invariant relied on by later in-place writers.  ESP input
> checks skb_has_shared_frag() before deciding whether an uncloned
> nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that
> skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is
> decrypted in place, letting an unprivileged user write into the page
> cache of a root-owned read-only file.
>
> Propagate SKBFL_SHARED_FRAG when frag descriptors are copied, as done for
> the other frag-transfer helpers.
>
> Fixes: af2806f8f90a ("net: Export skb_zerocopy() to zerocopy from one skb to another")
> Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags")
> Cc: stable@kernel.org
> Signed-off-by: Zizhen Liu <pointerliu@126.com>

Reviewed-by: Eric Dumazet <edumazet@kernel.org>

Thanks!

Re: [PATCH v2 net] net: skbuff: propagate shared-frag marker in skb_zerocopy()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 22 Oct 2026 18:42:17 +0800 you wrote:
> skb_zerocopy() moves frag descriptors from @from into @to and takes a
> reference on each frag, but it does not copy skb_shinfo(from)->flags into
> skb_shinfo(to)->flags.  A destination skb holding the same page-cache
> backed frags as the source therefore reports skb_has_shared_frag() as
> false.
> 
> That breaks the invariant relied on by later in-place writers.  ESP input
> checks skb_has_shared_frag() before deciding whether an uncloned
> nonlinear skb can skip skb_cow_data(); with the marker lost, an skb that
> skb_zerocopy() built for nfnetlink_queue or for an openvswitch upcall is
> decrypted in place, letting an unprivileged user write into the page
> cache of a root-owned read-only file.
> 
> [...]

Here is the summary with links:
  - [v2,net] net: skbuff: propagate shared-frag marker in skb_zerocopy()
    https://git.kernel.org/netdev/net/c/79dc34beb1fd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html