github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: core: fix head-page leak in skb_zerocopy

Browse Source 
When skb_orphan_frags() throws -ENOMEM, skb_copy_ubufs() may have
already reallocated and replaced 'from->head'. Accessing from->head to
drop the old refcount leaks the original head page, and erroneously
puts an unrelated new buffer. Use the local 'page' tracker variable
instead to drop the reference properly.

Fixes: 36d5fe6a00 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors")
Signed-off-by: Mina Almasry <almasrymina@google.com>
Link: https://patch.msgid.link/20260823183602.1051453-2-almasrymina@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Mina Almasry 2026-08-23 18:36:02 +00:00 committed by Paolo Abeni
parent 00e11ee983
commit 97148bcb75
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/core/skbuff.c
View File

@ -3910,7 +3910,7 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
}
if (!skb_frags_readable(from) && j > 0 && len) {
put_page(virt_to_head_page(from->head));
put_page(page);
return -EFAULT;
}
@ -3918,7 +3918,7 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
if (j > 0)
put_page(virt_to_head_page(from->head));
put_page(page);
return -ENOMEM;
}
skb_zerocopy_clone(to, from, GFP_ATOMIC);