Kyle Zeng dc4dd12f80 net/packet: check TX_RING fragments before memory accounting ... tpacket_fill_skb() adds the full non-linear payload length to skb->truesize and sk_wmem_alloc before checking MAX_SKB_FRAGS. With PACKET_VNET_HDR, userspace can submit a ring-sized frame even when it greatly exceeds the device MTU. A near-INT_MAX frame can saturate sk_wmem_alloc before the fragment loop rejects it. A subsequent refcount_add(0x40000001) can temporarily turn REFCOUNT_SATURATED into 1. A concurrent TX completion can then drop that apparent last reference and free the still-live packet socket before refcount_warn_saturate() restores the counter. Check that the remaining payload fits in MAX_SKB_FRAGS pages before accounting it. Include the initial page offset in the calculation, and move the existing -EFAULT handling out of the fragment loop. This preserves the accepted packet sizes and error code while preventing an invalid frame from injecting an oversized byte charge. Fixes: 69e3c75f4d ("net: TX_RING and packet mmap") Cc: stable@vger.kernel.org Cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com> Signed-off-by: Kyle Zeng <kylebot@openai.com> [edumazet: use net_warn_ratelimited() instead of pr_err(), add a Fixes: tag] Signed-off-by: Eric Dumazet <edumazet@kernel.org> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20261028181450.2221013-1-edumazet@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-10-29 08:58:08 -07:00
..
af_packet.c	net/packet: check TX_RING fragments before memory accounting	2026-10-29 08:58:08 -07:00
diag.c	net: change sock.sk_ino and sock_i_ino() to u64	2026-03-06 14:31:26 +01:00
internal.h	net/packet: avoid truncating TPACKET_V3 private size	2026-09-16 17:29:11 -07:00
Kconfig
Makefile