[PATCH bpf] bpf: Fix page double free in test_bpf skb setup

[PATCH bpf] bpf: Fix page double free in test_bpf skb setup

[Nicholas Dudar]

build_test_skb() transfers page ownership to an skb with
skb_add_rx_frag(). If either allocation in the second loop iteration fails,
kfree_skb() releases page[0], but the error path then falls through and
frees page[0] again.

Return after freeing skb[0], since page[0] is already owned by the skb at
that point; the raw page cleanup is only correct for the first iteration.

Fixes: 76db8087c4c9 ("net: bpf: add a test for skb_segment in test_bpf module")
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
---
Please queue this fix for stable. The double-free has been present since
v4.17 and is reachable when the test_bpf skb test encounters an allocation
failure.

A separate bpf-next patch allowing TEST_BPF=y depends on this fix and will
be posted after this patch.

---
 lib/test_bpf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index af6f3340c034..6104b97764bb 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -15214,6 +15214,7 @@ err_skb1:
 	__free_page(page[1]);
 err_page1:
 	kfree_skb(skb[0]);
+	return NULL;
 err_skb0:
 	__free_page(page[0]);
 err_page0:

base-commit: c0b95a11b38b47ed4b88fa2cebd86bfc4b244c5d

Re: [PATCH bpf] bpf: Fix page double free in test_bpf skb setup

[Alexei Starovoitov]

On Thu Sep 17, 2026 at 2:38 AM UTC, Nicholas Dudar wrote:
> build_test_skb() transfers page ownership to an skb with
> skb_add_rx_frag(). If either allocation in the second loop iteration fails,
> kfree_skb() releases page[0], but the error path then falls through and
> frees page[0] again.
>
> Return after freeing skb[0], since page[0] is already owned by the skb at
> that point; the raw page cleanup is only correct for the first iteration.
>
> Fixes: 76db8087c4c9 ("net: bpf: add a test for skb_segment in test_bpf module")
> Assisted-by: Codex:gpt-6-astra
> Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com>
> ---
> Please queue this fix for stable. The double-free has been present since
> v4.17 and is reachable when the test_bpf skb test encounters an allocation
> failure.

No.
I don't think you have a way to reproduce it.
We don't scream "bug... apply to stable" just because AI found a tiny
race.

pw-bot: cr