Re: [PATCH] net: skbuff: preserve fclone lifetime when freeing stolen heads

[patchwork-bot+netdevbpf@kernel.org]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 29 Oct 2026 21:23:29 -0700 you wrote:
> skb_morph() can give an skb from skbuff_fclone_cache a page-fragment
> head without changing its fclone tag. IPv4 reassembly can produce such
> an skb, which can subsequently reach the GRO stolen-head path.
> 
> napi_skb_free_stolen_head() puts the shell into the ordinary NAPI skb
> cache without dropping its fclone_ref. If the embedded companion is
> still live, KASAN poisons it along with the original, and later cache
> reuse or eviction can overwrite or free the allocation underneath it.
> A mirrored batman-adv DAT packet retained in a plug qdisc reproduces a
> KASAN use-after-free in plug_dequeue().
> 
> [...]

Here is the summary with links:
  - net: skbuff: preserve fclone lifetime when freeing stolen heads
    https://git.kernel.org/netdev/net/c/86706ffa990e

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html