superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
mirror-linux/net/core
History
Pavel Begunkov ff6e798c2e net: skbuff: fix pskb_carve leaking zcopy pages 
When SKBFL_MANAGED_FRAG_REFS is set, frag pages are not refcounted but
their lifetime is controlled by the attached ubuf_info. To make a copy
of the skb_shared_info, we either should clear the flag and reference
the frags, or keep the flag and have frags unreferenced.

pskb_carve_inside_header() and pskb_carve_inside_nonlinear() don't
follow the rule and thus can leak page references. Let's clear
SKBFL_MANAGED_FRAG_REFS from the original skb to fix it. It's the
simplest way to address it, but there are more performant ways to do
that if it ever becomes a problem.

Link: https://lore.kernel.org/all/20260523085809.26331-1-nvminh232@clc.fitus.edu.vn/
Fixes: 753f1ca4e1 ("net: introduce managed frags infrastructure")
Reported-by: Minh Nguyen <minhnguyen.080505@gmail.com>
Reported-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/1e2086aa69217d7f9c8da3d38f5be7160f1b4cd1.1779993185.git.asml.silence@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		2026-05-29 12:55:27 -07:00
..
Makefile net: get rid of net/core/request_sock.c 2026-02-05 09:23:05 -08:00
bpf_sk_storage.c bpf: Fix sk_local_storage diag dumping uninitialized special fields 2026-04-24 11:21:34 -07:00
datagram.c net: datagram: introduce datagram_poll_queue for custom receive queues 2025-10-23 15:46:04 +02:00
dev.c net: napi: Avoid gro timer misfiring at end of busypoll 2026-05-08 15:02:32 -07:00
dev.h net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work 2026-04-21 12:50:03 +02:00
dev_addr_lists.c net: warn ops-locked drivers still using ndo_set_rx_mode 2026-04-21 12:50:25 +02:00
dev_addr_lists_test.c net: cache snapshot entries for ndo_set_rx_mode_async 2026-04-21 12:50:13 +02:00
dev_api.c net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work 2026-04-21 12:50:03 +02:00
dev_ioctl.c net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work 2026-04-21 12:50:03 +02:00
devmem.c net: devmem: reject dma-buf bind with non-page-aligned size or SG length 2026-05-20 18:59:01 -07:00
devmem.h net: inline net_is_devmem_iov() 2026-01-25 13:18:53 -08:00
drop_monitor.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
dst.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
dst_cache.c net: dst: annotate data-races around dst->obsolete 2025-07-02 14:32:29 -07:00
failover.c net: net_failover: Fix the deadlock in slave register 2026-05-13 19:01:03 -07:00
fib_notifier.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
fib_rules.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2025-04-17 12:26:50 -07:00
filter.c bpf: sockmap: fix tail fragment offset in bpf_msg_push_data 2026-05-29 12:38:35 -07:00
flow_dissector.c flow_dissector: do not dissect PPPoE PFC frames 2026-04-20 11:35:16 -07:00
flow_offload.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
gen_estimator.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
gen_stats.c
…
gro.c net: gro: don't merge zcopy skbs 2026-05-21 08:21:33 -07:00
gro_cells.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
gso.c
…
hotdata.c net: remove EXPORT_IPV6_MOD() and EXPORT_IPV6_MOD_GPL() macros 2026-03-29 11:21:22 -07:00
hwbm.c
…
ieee8021q_helpers.c net: ieee8021q: fix insufficient table-size assertion 2025-07-01 12:55:49 +02:00
link_watch.c net/sched: do not reset queues in graft operations 2026-03-09 18:55:55 -07:00
lock_debug.c netdev: fix the locking for netdev notifications 2025-04-17 18:55:14 -07:00
lwt_bpf.c bpf: remove ipv6_bpf_stub completely and use direct function calls 2026-03-29 11:21:24 -07:00
lwtunnel.c inet: Remove rtnl_is_held arg of lwtunnel_valid_encap_type(_attr)?(). 2025-05-20 19:18:24 -07:00
mp_dmabuf_devmem.h
…
neighbour.c neigh: let neigh_xmit take skb ownership 2026-04-27 19:02:11 -07:00
net-procfs.c net: add proper RCU protection to /proc/net/ptype 2026-02-03 19:20:30 -08:00
net-sysfs.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
net-sysfs.h net: add skb_defer_disable_key static key 2026-03-12 19:25:33 -07:00
net-traces.c
…
net_namespace.c Networking changes for 7.1. 2026-04-14 18:36:10 -07:00
net_test.c
…
netclassid_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
netdev-genl-gen.c net: Add queue-create operation 2026-04-09 18:21:45 -07:00
netdev-genl-gen.h net: Add queue-create operation 2026-04-09 18:21:45 -07:00
netdev-genl.c net: remove the netif_get_rx_queue_lease_locked() helpers 2026-04-09 18:26:28 -07:00
netdev_config.c net: add queue config validation callback 2026-01-23 11:49:02 -08:00
netdev_queues.c net: remove the netif_get_rx_queue_lease_locked() helpers 2026-04-09 18:26:28 -07:00
netdev_rx_queue.c net: Rename ifq_idx to rxq_idx in netif_mp_* helpers 2026-04-12 09:12:07 -07:00
netevent.c
…
netmem_priv.h Revert "mm: introduce a new page type for page pool in page type" 2026-05-21 19:06:13 -07:00
netpoll.c netpoll: normalize skb->dev to the netpoll device 2026-05-21 08:10:18 -07:00
netprio_cgroup.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
of_net.c
…
page_pool.c Revert "mm: introduce a new page type for page pool in page type" 2026-05-21 19:06:13 -07:00
page_pool_priv.h net: page_pool: don't try to stash the napi id 2025-01-27 14:37:41 -08:00
page_pool_user.c page_pool: store detach_time as ktime_t to avoid false-negatives 2026-03-10 19:03:34 -07:00
pktgen.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
ptp_classifier.c
…
rtnetlink.c net: bridge: prevent too big nested attributes in br_fill_linkxstats() 2026-05-21 08:47:36 -07:00
scm.c net: use ktime_t in struct scm_timestamping_internal 2026-03-04 17:53:34 -08:00
secure_seq.c tcp: secure_seq: add back ports to TS offset 2026-03-04 17:44:35 -08:00
selftests.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
skb_fault_injection.c
…
skbuff.c net: skbuff: fix pskb_carve leaking zcopy pages 2026-05-29 12:55:27 -07:00
skmsg.c bpf, skmsg: fix verdict sk_data_ready racing with ktls rx 2026-05-20 17:21:21 -07:00
sock.c tcp: update window_clamp when SO_RCVBUF is set 2026-04-13 15:32:35 +02:00
sock_destructor.h
…
sock_diag.c net: Add SPDX ids to some source files 2026-03-09 18:32:45 -07:00
sock_map.c sockmap: Fix sk_psock_drop() race vs sock_map_{unhash,close,destroy}(). 2026-04-23 18:24:02 -07:00
sock_reuseport.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
stream.c net: stream: add description for sk_stream_write_space() 2025-07-18 16:57:21 -07:00
sysctl_net_core.c net: add skb_defer_disable_key static key 2026-03-12 19:25:33 -07:00
timestamping.c net: Add the possibility to support a selected hwtstamp in netdevice 2024-12-16 12:51:40 +00:00
tso.c net: tso: Introduce tso_dma_map and helpers 2026-04-12 10:54:31 -07:00
utils.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
xdp.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00