Re: [PATCH net] net: gro: don't copy frags between mixed zcopy skbs

[Pavel Begunkov <asml.silence@gmail.com>]

On 5/19/26 15:59, Sabrina Dubroca wrote:
> 2026-05-19, 15:39:19 +0100, Pavel Begunkov wrote:
>> On 5/19/26 13:40, Sabrina Dubroca wrote:
>>> skb_gro_receive() can currently copy frags between the source and GRO
>>> skb, without checking the zerocopy status, and in particular the
>>> SKBFL_MANAGED_FRAG_REFS flag.
>>>
>>> When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference
>>> on the pages in shinfo->frags. Appending those frags to another skb's
>>> frags without fixing up the page refcount can lead to UAF.
>>>
>>> When either the last skb in the GRO chain (the one we would append
>>> frags to) or the source skb is zerocopy, skip the frags copy, and just
>>> append the new skb to the frag_list.
>>
>> Was it reproduced? Sounds like we're missing skb_orphan_frags_rx()
>> as skbs looping into rx should be orphaned.
>>
>> +cc Willem
> 
> Yes, as I wrote in the patch:
> 
> Huzaifa has found this to be exploitable to overwrite the page cache

I know, I know, but I had to ask as since recently there are too many
reports where the exact wording wouldn't mean anything sensible.
Thanks for clarifying!

-- 
Pavel Begunkov