Re: [PATCH net] net: fix frag_list leak in skb_segment_list() error path

[Jiayuan Chen <jiayuan.chen@linux.dev>]

On 10/22/26 12:18 AM, Eric Dumazet wrote:
> skb_segment_list() detaches the frag_list from the head skb and moves
> its members one by one to the skb->next chain. On error, err_linearize
> frees that chain with kfree_skb_list(skb->next), relying on the members
> not yet processed to still be linked after the current one.
>
> This does not hold when the current member was shared: it is replaced
> by skb_clone(), and __skb_clone() clears ->next. If __skb_linearize()
> then fails on that clone, the remaining members are no longer reachable
> from skb->next nor from skb_shinfo(skb)->frag_list, and they leak.
>
> The skb_shared() error branch already relinks nskb->next to list_skb
> before jumping to err_linearize. Do it unconditionally right after nskb
> is added to the chain, so every error exit sees the remaining members.
> On the last member list_skb is NULL, which still terminates the chain.
>
> Fixes: 53475c5dd856 ("net: fix use-after-free when UDP GRO with shared fraglist")
> Signed-off-by: Eric Dumazet <edumazet@kernel.org>
> Cc: Simon Polack <spolack+git@mailbox.org>



Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>


> ---
> Bug discovered while reviewing at Simon Polack upcoming patch in
> skb_segment_list()
>
>   net/core/skbuff.c | 9 ++++++---
>   1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index ab178af02a2262d65175daff7f093c85eaa09c92..beddbf6812b9f387672c7ab5f0a1c07ab9bd0806 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -4734,10 +4734,13 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
>   		else
>   			tail->next = nskb;
>   
> -		if (unlikely(err)) {
> -			nskb->next = list_skb;
> +		/* nskb may be a clone with a NULL ->next: keep the remaining
> +		 * members linked so that err_linearize frees them.
> +		 */
> +		nskb->next = list_skb;
> +
> +		if (unlikely(err))
>   			goto err_linearize;
> -		}
>   
>   		tail = nskb;
>