Sabrina Dubroca 4db79a322d net: gro: don't merge zcopy skbs ... skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs. Fixes: 753f1ca4e1 ("net: introduce managed frags infrastructure") Reported-by: Huzaifa Sidhpurwala <huzaifas@redhat.com> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/c3b7f906bbfcbdfd7b4fa9d6c18a438870df85be.1779307748.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-05-21 08:21:33 -07:00
..
6lowpan	…
9p	9p/trans_xen: replace simple_strto* with kstrtouint	2026-04-16 02:57:01 +00:00
802	…
8021q	8021q: delete cleared egress QoS mappings	2026-04-23 12:13:57 +02:00
appletalk	net: appletalk: fix NULL pointer dereference in aarp_send_ddp()	2026-05-18 16:33:34 -07:00
atm	net: atm: fix skb leak in sigd_send() default branch	2026-05-12 18:07:02 -07:00
batman-adv	batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface	2026-05-19 10:43:54 +02:00
bluetooth	Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()	2026-05-20 16:35:47 -04:00
bpf	bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb	2026-04-12 15:42:57 -07:00
bridge	bridge: mcast: Fix a possible use-after-free when removing a bridge port	2026-05-19 18:15:22 -07:00
can	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
ceph	libceph: Fix slab-out-of-bounds access in auth message processing	2026-04-22 01:40:23 +02:00
core	net: gro: don't merge zcopy skbs	2026-05-21 08:21:33 -07:00
dcb	…
devlink	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-09 13:20:59 -07:00
dns_resolver	…
dsa	net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops	2026-04-16 19:10:48 -07:00
ethernet	bonding: prevent potential infinite loop in bond_header_parse()	2026-03-16 19:29:45 -07:00
ethtool	ethtool: fix ethnl_bitmap32_not_zero() bit interval semantics	2026-05-12 18:45:13 -07:00
handshake	…
hsr	net: hsr: defer node table free until after RCU readers	2026-05-15 18:25:26 -07:00
ieee802154	…
ife	…
ipv4	net: skbuff: propagate shared-frag marker through frag-transfer helpers	2026-05-21 11:31:05 +02:00
ipv6	ipv6: ioam: refresh hdr pointer before ioam6_event()	2026-05-21 08:19:25 -07:00
iucv	net/iucv: Add missing kernel-doc return value descriptions	2026-03-31 20:14:56 -07:00
kcm	…
key	vfs-7.1-rc1.kino	2026-04-13 12:19:01 -07:00
l2tp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-09 13:20:59 -07:00
l3mdev	…
lapb	…
llc	llc: Return -EINPROGRESS from llc_ui_connect()	2026-04-23 11:40:39 -07:00
mac80211	wifi: mac80211: remove station if connection prep fails	2026-05-06 11:02:57 +02:00
mac802154	bonding: prevent potential infinite loop in bond_header_parse()	2026-03-16 19:29:45 -07:00
mctp	net: mctp: test: Use dev_direct_xmit for TX to our test device	2026-04-30 13:36:47 -07:00
mpls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-02 11:03:13 -07:00
mptcp	mptcp: update window_clamp on subflows when SO_RCVBUF is set	2026-05-19 15:36:35 +02:00
ncsi	…
netfilter	netfilter: nf_queue: hold bridge skb->dev while queued	2026-05-16 13:23:01 +02:00
netlabel	…
netlink	genetlink: free the skb on 'group >= family->n_mcgrps'	2026-05-08 15:43:29 -07:00
nfc	NFC: digital: Bounds check NFC-A cascade depth in SDD response handler	2026-04-12 11:40:45 -07:00
nsh	…
openvswitch	openvswitch: vport: fix race between linking and the device notifier	2026-05-18 16:38:45 -07:00
packet	net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()	2026-04-22 20:16:34 -07:00
phonet	phonet/pep: disable BH around forwarded sk_receive_skb()	2026-05-21 07:38:21 -07:00
psample	…
psp	psp: strip variable-length PSP header in psp_dev_rcv()	2026-05-04 19:25:14 -07:00
qrtr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-14 12:04:00 -07:00
rds	rds_tcp: close NULL deref window in rds_tcp_set_callbacks	2026-05-14 17:06:59 -07:00
rfkill	net: rfkill: prevent unlimited numbers of rfkill events from being created	2026-04-07 12:35:04 +02:00
rxrpc	rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer	2026-05-20 16:36:45 -07:00
sched	net/sched: sch_cbs: Call qdisc_reset for child qdisc	2026-05-13 17:53:39 -07:00
sctp	sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL	2026-05-08 18:21:09 -07:00
shaper	net: shaper: rework the VALID marking (again)	2026-05-20 16:34:20 -07:00
smc	net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot	2026-05-14 12:20:06 +02:00
strparser	net: strparser: fix skb_head leak in strp_abort_strp()	2026-04-14 12:37:00 +02:00
sunrpc	NFS client updates for Linux 7.1	2026-04-24 14:20:03 -07:00
switchdev	bridge: No DEV_PATH_BR_VLAN_UNTAG_HW for dsa foreign	2026-03-19 13:14:00 +01:00
tipc	Including fixes from Netfilter.	2026-04-23 16:50:42 -07:00
tls	tls: Preserve sk_err across recvmsg() when data has been copied	2026-05-14 18:19:44 -07:00
unix	af_unix: Fix UAF read of tail->len in unix_stream_data_wait()	2026-05-19 18:53:56 -07:00
vmw_vsock	vsock/virtio: fix skb overhead accounting to preserve full buf_alloc	2026-05-21 13:14:01 +02:00
wireless	wifi: nl80211: re-check wiphy netns in nl80211_prepare_wdev_dump() continuation	2026-05-06 11:08:41 +02:00
x25	vfs-7.1-rc1.kino	2026-04-13 12:19:01 -07:00
xdp	bpf-fixes	2026-05-09 18:42:54 -07:00
xfrm	xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete	2026-04-29 11:27:34 +02:00
Kconfig	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
Kconfig.debug	…
Makefile	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
compat.c	…
devres.c	…
socket.c	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
sysctl_net.c	…