Pavel Begunkov ff6e798c2e net: skbuff: fix pskb_carve leaking zcopy pages ... When SKBFL_MANAGED_FRAG_REFS is set, frag pages are not refcounted but their lifetime is controlled by the attached ubuf_info. To make a copy of the skb_shared_info, we either should clear the flag and reference the frags, or keep the flag and have frags unreferenced. pskb_carve_inside_header() and pskb_carve_inside_nonlinear() don't follow the rule and thus can leak page references. Let's clear SKBFL_MANAGED_FRAG_REFS from the original skb to fix it. It's the simplest way to address it, but there are more performant ways to do that if it ever becomes a problem. Link: https://lore.kernel.org/all/20260523085809.26331-1-nvminh232@clc.fitus.edu.vn/ Fixes: 753f1ca4e1 ("net: introduce managed frags infrastructure") Reported-by: Minh Nguyen <minhnguyen.080505@gmail.com> Reported-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/1e2086aa69217d7f9c8da3d38f5be7160f1b4cd1.1779993185.git.asml.silence@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-05-29 12:55:27 -07:00
..
6lowpan	…
9p	9p/trans_xen: replace simple_strto* with kstrtouint	2026-04-16 02:57:01 +00:00
802	…
8021q	8021q: delete cleared egress QoS mappings	2026-04-23 12:13:57 +02:00
appletalk	net: appletalk: fix NULL pointer dereference in aarp_send_ddp()	2026-05-18 16:33:34 -07:00
atm	net: atm: fix skb leak in sigd_send() default branch	2026-05-12 18:07:02 -07:00
batman-adv	batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface	2026-05-19 10:43:54 +02:00
bluetooth	Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync()	2026-05-28 08:52:21 -04:00
bpf	bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb	2026-04-12 15:42:57 -07:00
bridge	bridge: Fix sleep in atomic context in sysfs path	2026-05-27 17:23:05 -07:00
can	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
ceph	libceph: Fix potential null-ptr-deref in decode_choose_args()	2026-05-12 21:00:59 +02:00
core	net: skbuff: fix pskb_carve leaking zcopy pages	2026-05-29 12:55:27 -07:00
dcb	…
devlink	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-09 13:20:59 -07:00
dns_resolver	…
dsa	net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops	2026-04-16 19:10:48 -07:00
ethernet	…
ethtool	ethtool: eeprom: add more safeties to EEPROM Netlink fallback	2026-05-27 17:42:09 -07:00
handshake	net/handshake: Drain pending requests at net namespace exit	2026-05-28 13:35:32 +02:00
hsr	net: hsr: fix potential OOB access in supervision frame handling	2026-05-25 14:18:15 -07:00
ieee802154	…
ife	…
ipv4	tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()	2026-05-26 18:11:47 -07:00
ipv6	ipv6: fix possible infinite loop in fib6_select_path()	2026-05-29 12:41:00 -07:00
iucv	net/iucv: fix locking in .getsockopt	2026-05-22 17:40:32 -07:00
kcm	…
key	vfs-7.1-rc1.kino	2026-04-13 12:19:01 -07:00
l2tp	l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname	2026-05-26 17:35:12 -07:00
l3mdev	…
lapb	…
llc	llc: Return -EINPROGRESS from llc_ui_connect()	2026-04-23 11:40:39 -07:00
mac80211	wifi: mac80211: consume only present negotiated TTLM maps	2026-05-20 11:20:37 +02:00
mac802154	…
mctp	net: mctp: test: Use dev_direct_xmit for TX to our test device	2026-04-30 13:36:47 -07:00
mpls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-02 11:03:13 -07:00
mptcp	mptcp: update window_clamp on subflows when SO_RCVBUF is set	2026-05-19 15:36:35 +02:00
ncsi	…
netfilter	netfilter: nf_tables: fix dst corruption in same register operation	2026-05-22 12:28:46 +02:00
netlabel	…
netlink	net: netlink: don't set nsid on local notifications	2026-05-22 17:11:09 -07:00
nfc	nfc: hci: fix out-of-bounds read in HCP header parsing	2026-05-07 12:42:09 +02:00
nsh	…
openvswitch	openvswitch: vport: fix race between linking and the device notifier	2026-05-18 16:38:45 -07:00
packet	net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()	2026-04-22 20:16:34 -07:00
phonet	phonet/pep: disable BH around forwarded sk_receive_skb()	2026-05-21 07:38:21 -07:00
psample	…
psp	psp: strip variable-length PSP header in psp_dev_rcv()	2026-05-04 19:25:14 -07:00
qrtr	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-14 12:04:00 -07:00
rds	rds_tcp: close NULL deref window in rds_tcp_set_callbacks	2026-05-14 17:06:59 -07:00
rfkill	net: rfkill: prevent unlimited numbers of rfkill events from being created	2026-04-07 12:35:04 +02:00
rxrpc	rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer	2026-05-20 16:36:45 -07:00
sched	net/sched: act_mirred: Fix return code in early mirred redirect error paths	2026-05-28 12:26:36 +02:00
sctp	sctp: fix race between sctp_wait_for_connect and peeloff	2026-05-28 16:36:08 -07:00
shaper	net: shaper: rework the VALID marking (again)	2026-05-20 16:34:20 -07:00
smc	net/smc: Do not re-initialize smc hashtables	2026-05-22 17:38:02 -07:00
strparser	net: strparser: fix skb_head leak in strp_abort_strp()	2026-04-14 12:37:00 +02:00
sunrpc	nfsd-7.1 fixes:	2026-05-26 13:49:13 -07:00
switchdev	…
tipc	Including fixes from Netfilter.	2026-04-23 16:50:42 -07:00
tls	tls: Preserve sk_err across recvmsg() when data has been copied	2026-05-14 18:19:44 -07:00
unix	af_unix: Fix UAF read of tail->len in unix_stream_data_wait()	2026-05-19 18:53:56 -07:00
vmw_vsock	vsock/virtio: bind uarg before filling zerocopy skb	2026-05-29 12:38:00 -07:00
wireless	wifi: cfg80211: wext: validate chandef in monitor mode	2026-05-20 11:44:19 +02:00
x25	vfs-7.1-rc1.kino	2026-04-13 12:19:01 -07:00
xdp	bpf-fixes	2026-05-09 18:42:54 -07:00
xfrm	xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete	2026-04-29 11:27:34 +02:00
Kconfig	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
Kconfig.debug	…
Makefile	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
compat.c	…
devres.c	…
socket.c	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
sysctl_net.c	…