From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 46A653ED5C9 for ; Tue, 25 Aug 2026 09:25:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787649920; cv=none; b=Nj5y/uYesopUa6fjf+MWzJpL1P4swzsag3Kph25MvS74Eas1n/ZjaEsMu8LbeP/M7ECBs1LtFzE773U7Y4/IbsSuRiptFUv5kmOT5DPok6eUiSQqML2nFL65Hgm/N6nfbvctc2Bvt/klQHahjn55tS8Ob7zkbS1KrevCZ22/c5o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787649920; c=relaxed/simple; bh=2VOaBUpATXZRwbhL/FrnLwVbT0d3UAjrcJ6WZRBSgT8=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=ih96b+CQq4syPhIpxAkN/TAuGDd60QDkH400JSFp/vfaJo66oiRiiTiLgEFFNDMBP+fZtPu1yc/7d9bAE22jiJdsR6rHLXJ6Mtsmv1rann1mhig5ghbE2xlMaKiTLbXh37CDon/Hl/qCg2ZEvcIU8V96ZD2hZeJ5gACNTlqd+uA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=NvaTZDJA; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=jZD9N59E; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="NvaTZDJA"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="jZD9N59E" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1787649917; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=pizwoZrUNOGE4XnyAc+Px/F4HEZsDeJxYwjxqwe6X58=; b=NvaTZDJA/jOk9yUQh9v3+/Pf1NWX8aAh8qgo4TEIz0iJmYCyYmUMSEmaOiehJmmj9++IgM bhsBqWBV/FmMMGUWkOFA1+LdIqhljiyZ3WeAyTG1cO0cdBwwk3wKhhU7f+BYbxKkejEOfc qf2dQVcybzifUa8KElQ5bcrVWR6OqWk= Received: from mail-ej1-f69.google.com (mail-ej1-f69.google.com [209.85.218.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-643-A846-55AOG2GsPVvujanNg-1; Tue, 25 Aug 2026 05:25:16 -0400 X-MC-Unique: A846-55AOG2GsPVvujanNg-1 X-Mimecast-MFC-AGG-ID: A846-55AOG2GsPVvujanNg_1787649915 Received: by mail-ej1-f69.google.com with SMTP id a640c23a62f3a-c1630a90890so314657966b.1 for ; Tue, 25 Aug 2026 02:25:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1787649915; x=1788254715; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:from:to:cc:subject:date:message-id:reply-to:content-type; bh=pizwoZrUNOGE4XnyAc+Px/F4HEZsDeJxYwjxqwe6X58=; b=jZD9N59EBHOck+tetC8VRbaLQZRgsfa8RDr5oDRUyoPske9FKn2tsn5X82GpSj48Jk s9JOsIvzGv+id5f09Y7A/Rf+VRdhTkxs9wIV1bGwBhNKeUuDSYrYme0+9iGs9oi4LJqI osDzalymP8uE7oWWC47pVjouuVLwsUCQmQ2vhAJljqYNyJZOVsTjjF1Ga9dmepMPDbhs a1vgJKZ6Uq3QEHWgbkwb9yF40l8e/J/PCg2R9jcPxezOVACXOAqes57P8gZdHGJAvaA9 FVYPo/dxGdvOguISLjM85WZVaS7LOwXoVGaf9XYu5iuN8tRJcsoIhOLkKl9TUTART+tR zg6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787649915; x=1788254715; h=content-transfer-encoding:content-type:in-reply-to:content-language :from:references:cc:to:subject:user-agent:mime-version:date :message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pizwoZrUNOGE4XnyAc+Px/F4HEZsDeJxYwjxqwe6X58=; b=Z1hwqQaTgOGzGftYgMcFl6GbeM3uQMFvkbm8RGMZoiDzx0yfefw5jR19Wch1ZmFLXQ D9xLaGmhBvFqXk7rQKNU1vgsEmgIZdC0kHflws4qhnmuW6iob0RzfIifoQfuxk7IDBeS zAWB52Q5zbjHzzTsQ9nIqsweOoRDt+cpZWPzc42bJmGO74Je16zjzIqbJpqJazkIRDPy Dy4Cj+lSPbzF6Cn4eoM7+nX/o7NzsHQsvafuWhuXzbePXcQAnb9aQcz48rybipy9IXAH V4Q1FqN/eioDDRibqZ5cWqfZusQgsO0Lux7dhypaf0sEe3ogO1tM61K3JEGsm3qtEQJx dqfg== X-Forwarded-Encrypted: i=1; AHgh+RqW6FtrJiCXQvbRwXJMXv9QzUYdUnEFxpwcdF9dCsAq7d59euCZSfZcsv8x+oOIYBZhkWvIKyEbZYtfkfY=@vger.kernel.org X-Gm-Message-State: AFuF++kGZ22KJ1ky547RF0nd7GDVfD8JY1RAjHuDT6L9bJOFMQxedxLg r4C4JA1wPsDSSAdks0mTYE8KIE2VY7snu7MdojnWXy1LKsMZfHfTCHjpmllXRjg4mOWVLU/c3jI ItdDJXXTMqvmxmpaZkILnJqj9M3s47qrzgq+Y0b7Z3lGgm/HUQF4uBZAH+U9J7Eob2g== X-Gm-Gg: AR+sD11Lt5vApRRruWFSCzXBHWB90M9gKGu5jcJbq52GBZ7hMKPVSkeXMQu20F+FhUd xsUg2mIJEELUPii+wFJGVdXPQAvofMa8kaJ0VDmKTUFTOOw5Rbpmkr1KesycWhgxPOn2RMKm8fo uXRaFmfj8P+kDZUjq+NAWWhk49zWQV9+RiSKXMks0md0E9zhA8M+X1fwOh7ArqMSMf74EovKsMV jMHBYLj4JqnOAAKCfGvj6Mo34KO7XnsIfQPE0xdCXGS2PFQVHEs3hqzY9PzgKIusLjSKZCW858A uDeWEqPx9NQvPILLs0CmpPnHyN70bay8apUiITETwmyFAxxN0T+gANb5Sgvx8ZqNr7OldEah5LH BV3dV/9fypvrdIsBoPynbyCy9v97RUOnv7lTH29LhyLH7W8ucoHN42my/kO9Mky/2x8josg3/ X-Received: by 2002:a17:907:a703:b0:c16:13c3:b1ef with SMTP id a640c23a62f3a-c246a73b5b7mr3901012766b.24.1787649914652; Tue, 25 Aug 2026 02:25:14 -0700 (PDT) X-Received: by 2002:a17:907:a703:b0:c16:13c3:b1ef with SMTP id a640c23a62f3a-c246a73b5b7mr3901002366b.24.1787649914109; Tue, 25 Aug 2026 02:25:14 -0700 (PDT) Received: from [192.168.188.103] (ip46-47-231-195.pool-bba.aruba.it. [195.231.47.46]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c24968665e0sm1502866566b.53.2026.08.25.02.25.12 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 25 Aug 2026 02:25:13 -0700 (PDT) Message-ID: Date: Tue, 25 Aug 2026 11:25:11 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net v1 2/2] net: core: fix head-page leak in skb_zerocopy To: Mina Almasry , Jakub Kicinski , Kaiyuan Zhang , Willem de Bruijn , Eric Dumazet , Zoltan Kiss , "David S. Miller" , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Simon Horman , Jason Xing References: <20260823183602.1051453-1-almasrymina@google.com> <20260823183602.1051453-2-almasrymina@google.com> From: Paolo Abeni Content-Language: en-US In-Reply-To: <20260823183602.1051453-2-almasrymina@google.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 8/23/26 8:36 PM, Mina Almasry wrote: > When skb_orphan_frags() throws -ENOMEM, skb_copy_ubufs() may have > already reallocated and replaced 'from->head'. Accessing from->head to > drop the old refcount leaks the original head page, and erroneously > puts an unrelated new buffer. Use the local 'page' tracker variable > instead to drop the reference properly. > > Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors") > > Signed-off-by: Mina Almasry Note that there must be no empty lines in the tag area; no need to repost, I'll fix it while applying. /P