On 5/19/26 15:59, Sabrina Dubroca wrote:

2026-05-19, 15:39:19 +0100, Pavel Begunkov wrote:

quoted

On 5/19/26 13:40, Sabrina Dubroca wrote:

quoted

skb_gro_receive() can currently copy frags between the source and GRO
skb, without checking the zerocopy status, and in particular the
SKBFL_MANAGED_FRAG_REFS flag.

When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference
on the pages in shinfo->frags. Appending those frags to another skb's
frags without fixing up the page refcount can lead to UAF.

When either the last skb in the GRO chain (the one we would append
frags to) or the source skb is zerocopy, skip the frags copy, and just
append the new skb to the frag_list.

Was it reproduced? Sounds like we're missing skb_orphan_frags_rx()
as skbs looping into rx should be orphaned.

+cc Willem

Yes, as I wrote in the patch:

Huzaifa has found this to be exploitable to overwrite the page cache

I know, I know, but I had to ask as since recently there are too many
reports where the exact wording wouldn't mean anything sensible.
Thanks for clarifying!

-- 
Pavel Begunkov