From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lf1-f47.google.com (mail-lf1-f47.google.com [209.85.167.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8AEB83DD509 for ; Tue, 16 Jun 2026 19:00:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781636455; cv=none; b=EjzfUAwYVhM+UBeTKVxpvxRUwTkExREx2vqJ5gzPBd9BXu0xWlZ0QsljS4xLkJkJfJZu9L7Sf0OyRJ0VyxPtVOJ5WHd6Vn5hvbtYCX9jjHKI/3TtGZ6HYydTH+jfab1oUB6I6RAvzPXHYtpU8WgM/EyBT7PRRvpthzAnGEAtoO4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781636455; c=relaxed/simple; bh=9Tyx3IZ683JCdQMRbGJeTjnP9qW7Us8tqu9ScIW2eJ0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Og/mM23M1rVDBr49hZ5EovN029Qb232I8qCrcm9TXp3DmCb1tcuL4AQq/TYYL4WZsZo12Ei63sdW+/E8MucCs3wLj/Q6gPSz3tyqKbQnfPHJ67JmKLYKAJpSwvZsiLfbmLw/2E3LvzBPnIQDGY5qp+uMNwKJ5alRShCwEhEkaHk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bE3JPLzf; arc=none smtp.client-ip=209.85.167.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bE3JPLzf" Received: by mail-lf1-f47.google.com with SMTP id 2adb3069b0e04-5aa63628d26so4856145e87.0 for ; Tue, 16 Jun 2026 12:00:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781636453; x=1782241253; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=hAylVLBoI1FWIRaqnARn0iCZWEh0HddelhXPEdFepIU=; b=bE3JPLzf2Ayr90aodKGCy3QXSoUKQacdo32bqaaB1GxC8d2+KrbeH4ujPMw3Bl+Ln+ gwa8VvdpxKapffdh+G67FlMyVuI+I4LJO5A3Ccp8Egzw4O2fPhGc/BBWkC7ZhYQEDeTk sEzsTIJG7g/PLmIPt3tCUemUUa3VLAP3/7e9XztNdxOLb/V04V/OAVWbt6Cydr8jKasl A+3XsPRDsMxCfIRZQs5KueO/ftN/k6TvI6RamGeZ5cMrJHP20TIbEAS/oxVRHUi7sdMF lcdnCQ/+gPvXMBIOXVo3B3uGTWZaoapq+rFjBPnS+a4WThbrFNL7v0O2cnvObe91sd9N trsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781636453; x=1782241253; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=hAylVLBoI1FWIRaqnARn0iCZWEh0HddelhXPEdFepIU=; b=lSDdqnKDTMDEIVqcAtcItmWlxKJKrizZToa+G4szpi2zQK98jL3zz9JIQUfVzCgDSK yMVxjES/W+927Jl9T8bhwDytldeKEK9XFQ+npckdxcrhdf5rgpISJriKjh0eXHCh+kqI 3dZaBEtjwLDeiv1jAF7yQsceiDaCcTP4iBe9LJvmJRTlIosd9dCaPqVN6AukP+UFSoth 4ynCjK22fL+bY4um2jZLxHsZWD6GZDiI2n3spYUzUX7XVMN4p6RRH9hNIewvqlMJptvA 1rYFmCP8siLDOGem9PsOC9GbQvRGwuwRMYgNbMS1IUrdTiAdsh0sq1ZZMXV2oy+13KEa qJVA== X-Forwarded-Encrypted: i=1; AFNElJ+Uij0d4J51tmk5RYa6Wu1E/QMphctZMWb0dcd24uHE+H/ma0grLWJFSyD85P9K8p9eE0vprMgI3Pu1FFE=@vger.kernel.org X-Gm-Message-State: AOJu0YwyKftU+5QCAQN3sJsaU+NAgaqmbE6sAIPbYvMSEC/C1keP2nK3 /evONFeS4B9wVFc23KM/YlN6Y2XRLFVlOdSx8WK5CwASkuQhzfp3DXDj+nFPix0BvaDMNg== X-Gm-Gg: Acq92OFPhbsh+r1BKHDvEM48JURTSuUE1NgznXZMC1zi1mSWJqPUiVTOGYs37A4AT2x 21sohzn/WAWH8FqccsOxjnCXdV92lYANC5d0MFEPala/vlP+DVA+PpAPjxkqY/J/yBS8k6RiUyo kmOfnghiA6mUXARW6hWegEFE4Vlz8avduzWZTRja/cY6c92es6LgQbYqSKUt39vDWbgyVfbBNdX ba5INfc/OWAJHL5H8sU9g3OAlLCWn+buiZZtt2mccDSC/FFjts/SutwnfLVNcL4oNrVvFQBhL6C Ok9WZuIWRPR+Uoev1CHUluEpDb9/YzVZjUUkKbUXFGBeuKLSGkT5UZ2+ogGP3DiRhlCKjwMz6R0 X82ScbMOGOJ8/wC5yzOTYfgVo948ytMy7gkgWPCk/l1oJamy1EcuHAQAIOutNlCG7IYptQUqEL8 R0ZgnxyQWmWyJAvJ8P9KTQKpbquP1H61NgUGe9Y1o= X-Received: by 2002:a05:6512:baa:b0:5aa:74f8:72f4 with SMTP id 2adb3069b0e04-5ad46fe041bmr185686e87.32.1781636452394; Tue, 16 Jun 2026 12:00:52 -0700 (PDT) Received: from grower.astra-academy.ru ([185.32.135.49]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5ad2e124462sm3738075e87.0.2026.06.16.12.00.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jun 2026 12:00:51 -0700 (PDT) From: Alexander Martyniuk To: stable@vger.kernel.org, Greg Kroah-Hartman Cc: Alexander Martyniuk , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Sasha Levin , Sabrina Dubroca , Hyunwoo Kim , Pavel Begunkov , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, Huzaifa Sidhpurwala , Willem de Bruijn Subject: [PATCH 6.1] net: gro: don't merge zcopy skbs Date: Tue, 16 Jun 2026 22:00:36 +0000 Message-ID: <20260616220038.87364-1-alexevgmart@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Sabrina Dubroca commit 4db79a322db8c97f7b73b8a347395ef4d685eb40 upstream. skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs. Fixes: 753f1ca4e1e5 ("net: introduce managed frags infrastructure") Reported-by: Huzaifa Sidhpurwala Signed-off-by: Sabrina Dubroca Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/c3b7f906bbfcbdfd7b4fa9d6c18a438870df85be.1779307748.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski Signed-off-by: Alexander Martyniuk --- Backport fix for CVE-2026-46323 net/core/gro.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/gro.c b/net/core/gro.c index ea6571c01faa..c5a9733d929a 100644 --- a/net/core/gro.c +++ b/net/core/gro.c @@ -171,6 +171,9 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) if (p->pp_recycle != skb->pp_recycle) return -ETOOMANYREFS; + if (skb_zcopy(p) || skb_zcopy(skb)) + return -ETOOMANYREFS; + /* pairs with WRITE_ONCE() in netif_set_gro_max_size() */ gro_max_size = READ_ONCE(p->dev->gro_max_size); -- 2.30.2