[PATCH net v2] net: gro: don't merge zcopy skbs

[PATCH net v2] net: gro: don't merge zcopy skbs

[Sabrina Dubroca]

skb_gro_receive() can currently copy frags between the source and GRO
skb, without checking the zerocopy status, and in particular the
SKBFL_MANAGED_FRAG_REFS flag.

When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference
on the pages in shinfo->frags. Appending those frags to another skb's
frags without fixing up the page refcount can lead to UAF.

When either the last skb in the GRO chain (the one we would append
frags to) or the source skb is zerocopy, don't merge the skbs.

Fixes: 753f1ca4e1e5 ("net: introduce managed frags infrastructure")
Reported-by: Huzaifa Sidhpurwala <huzaifas@redhat.com>
Assisted-by: Claude:claude-mythos-preview
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
---
 net/core/gro.c | 3 +++
 1 file changed, 3 insertions(+)

v2: as Eric suggested, don't merge those skbs
v1: https://lore.kernel.org/netdev/4d583fc5401298453d0a2f1b4719a15be30c8e49.1779194090.git.sd@queasysnail.net/

Huzaifa has found this to be exploitable to overwrite the page cache

diff --git a/net/core/gro.c b/net/core/gro.c
index 31d21de5b15a..b22fb3ba7061 100644
--- a/net/core/gro.c
+++ b/net/core/gro.c
@@ -109,6 +109,9 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
+	if (skb_zcopy(skb) || skb_zcopy(lp))
+		return -ETOOMANYREFS;
+
 	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
 		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;
-- 
2.54.0

Re: [PATCH net v2] net: gro: don't merge zcopy skbs

[Sabrina Dubroca]

2026-05-20, 17:18:37 +0200, Sabrina Dubroca wrote:
> skb_gro_receive() can currently copy frags between the source and GRO
> skb, without checking the zerocopy status, and in particular the
> SKBFL_MANAGED_FRAG_REFS flag.
> 
> When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference
> on the pages in shinfo->frags. Appending those frags to another skb's
> frags without fixing up the page refcount can lead to UAF.
> 
> When either the last skb in the GRO chain (the one we would append
> frags to) or the source skb is zerocopy, don't merge the skbs.
> 
> Fixes: 753f1ca4e1e5 ("net: introduce managed frags infrastructure")
> Reported-by: Huzaifa Sidhpurwala <huzaifas@redhat.com>
> Assisted-by: Claude:claude-mythos-preview
> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
> ---
>  net/core/gro.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> v2: as Eric suggested, don't merge those skbs
> v1: https://lore.kernel.org/netdev/4d583fc5401298453d0a2f1b4719a15be30c8e49.1779194090.git.sd@queasysnail.net/
> 
> Huzaifa has found this to be exploitable to overwrite the page cache
> 
> diff --git a/net/core/gro.c b/net/core/gro.c
> index 31d21de5b15a..b22fb3ba7061 100644
> --- a/net/core/gro.c
> +++ b/net/core/gro.c
> @@ -109,6 +109,9 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
>  	if (p->pp_recycle != skb->pp_recycle)
>  		return -ETOOMANYREFS;
>  
> +	if (skb_zcopy(skb) || skb_zcopy(lp))
> +		return -ETOOMANYREFS;

Ugh I need holidays...

lp isn't initialized here. Sorry.

-- 
Sabrina

Re: [PATCH net v2] net: gro: don't merge zcopy skbs

[Paolo Abeni]

On 5/20/26 9:44 PM, Sabrina Dubroca wrote:
> 2026-05-20, 17:18:37 +0200, Sabrina Dubroca wrote:
>> diff --git a/net/core/gro.c b/net/core/gro.c
>> index 31d21de5b15a..b22fb3ba7061 100644
>> --- a/net/core/gro.c
>> +++ b/net/core/gro.c
>> @@ -109,6 +109,9 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb)
>>  	if (p->pp_recycle != skb->pp_recycle)
>>  		return -ETOOMANYREFS;
>>  
>> +	if (skb_zcopy(skb) || skb_zcopy(lp))
>> +		return -ETOOMANYREFS;
> 
> Ugh I need holidays...
> 
> lp isn't initialized here. Sorry.

I think everybody prefers to have this patch in tomorrow net PR. Please
post a v3 ASAP, not waiting for the 24h grace period.

Thanks,

Paolo