[PATCH net] ipv6: account for fraggap on the paged allocation path
From: Wongi Lee <hidden>
Date: 2026-06-08 15:39:17
On Wed, Jun 03, 2026 at 02:39:19AM +0900, Wongi Lee wrote:
On Tue, Jun 02, 2026 at 05:44:52PM +0200, Greg KH wrote:quoted
On Tue, Jun 02, 2026 at 10:52:16PM +0900, Wongi Lee wrote:quoted
On Fri, May 29, 2026 at 07:05:33PM +0200, Willy Tarreau wrote:quoted
On Sat, May 30, 2026 at 12:58:26AM +0900, Wongi Lee wrote:quoted
Hi, I'm reaching out to check on the progress of this issue. Would it be possible to get an update on where things currently stand?Let's wait for the maintainers to breathe a little bit, they get multiple reports like this one every single day. It's also possible this one fell through the cracks, so let's wait for their response first. Thanks, WillyHi Willy, First, my apologies if I came across as pushy. The reason I'm following up is that this bug is one of the bugs used in exploit, so from my perspective it would be good to get the fix applied sooner rather than later. I also recently read in the documentation that bugs found with the help of AI are encouraged to be reported on open channels such as netdev. If the security team sees no problem with it, I'd like to ask whether it would be okay to post the details of this bug to netdev.Do you have a proposed fix for this issue? if so, has it been sent here in a format it can be applied? If not, can you work on creating that? thanks, greg k-h
The maintainers have been busy lately and following Willy's suggestion on the earlier thread to resend this to netdev with the maintainers in Cc, I'd like to submit the patch here. As requested, I've removed the PoC from this submission. So the message below only describes the issue and the proposed fix. If the maintainers need any additional information including the PoC, I'm happy to provide it.
quoted hunk
For now, I'll send a summary to here. Below is the summarized email previously sent. Subject: [PATCH net] ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap), but the fraggap bytes carried over from the previous skb are copied into the new skb's linear area at offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The non-paged branch a few lines above sets alloclen = fraglen = datalen + fragheaderlen, which already accounts for fraggap because datalen does. Bring the paged branch in line by adding fraggap to alloclen and subtracting it from pagedlen. Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc") Reported-by: Wongi Lee <redacted> Reported-by: Jungwoo Lee <redacted> Assisted-by: Xint Signed-off-by: Wongi Lee <redacted> --- net/ipv6/ip6_output.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index c14adcdd4396..265502caa44b 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c@@ -1667,8 +1667,8 @@ static int __ip6_append_data(struct sock *sk, (fraglen + alloc_extra < SKB_MAX_ALLOC || !(rt->dst.dev->features & NETIF_F_SG))) alloclen = fraglen; else { - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; + alloclen = fragheaderlen + transhdrlen + fraggap; + pagedlen = datalen - transhdrlen - fraggap; } alloclen += alloc_extra;If there are formatting issue or needs additional information please let me know. The bug was triggered on v6.12.85, also found that the same code pattern is present in v7.1-rc3. KASAN [ 12.504958] Oops: general protection fault, probably for non-canonical address 0xe008444848484848: 0000 [#1] SMP KASAN NOPTI [ 12.508187] KASAN: maybe wild-memory-access in range [0x0042424242424240-0x0042424242424247] [ 12.511796] CPU: 1 UID: 1000 PID: 212 Comm: exploit Not tainted 6.12.85 #1 [ 12.513507] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 12.516423] RIP: 0010:kfree_skb_list_reason+0x18a/0x610 [ 12.517848] Code: 3c 18 00 0f 85 97 03 00 00 4c 89 7c d4 58 83 f9 10 0f 84 24 02 00 00 48 85 ed 0f 84 33 01 00 00 49 89 ef 4c 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 25 03 00 00 4d 8d af dc 00 00 00 be 04 00 00 00 [ 12.523857] RSP: 0018:ffffc90000d47b90 EFLAGS: 00010216 [ 12.524957] RAX: 0008484848484848 RBX: dffffc0000000000 RCX: 0000000000000000 [ 12.526917] RDX: 1ffff11001893159 RSI: 0000000000000002 RDI: ffffc90000d47c68 [ 12.528739] RBP: ffff88800c498ac0 R08: 0000000000000001 R09: fffff94000063d56 [ 12.530599] R10: ffffea000031eab7 R11: 0000000000000008 R12: 0000000000000002 [ 12.532545] R13: 1ffffffff5b8660d R14: ffffc90000d47be0 R15: 0042424242424242 [ 12.534509] FS: 0000000032dfd380(0000) GS:ffff8880be100000(0000) knlGS:0000000000000000 [ 12.536828] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.538500] CR2: 0000000000492c7a CR3: 0000000003dfa000 CR4: 0000000000350ef0 [ 12.540694] Call Trace: [ 12.541484] <TASK> [ 12.541959] ? __pfx_kfree_skb_list_reason+0x10/0x10 [ 12.543622] ? srso_return_thunk+0x5/0x5f [ 12.544613] ? srso_return_thunk+0x5/0x5f [ 12.545511] ? __wake_up+0x44/0x60 [ 12.546501] ? srso_return_thunk+0x5/0x5f [ 12.547913] skb_release_data+0x4c6/0x7f0 [ 12.549113] ? __ip6_flush_pending_frames+0x1c0/0x340 [ 12.550973] ? __ip6_flush_pending_frames+0x1c0/0x340 [ 12.552584] sk_skb_reason_drop+0xf1/0x320 [ 12.554091] __ip6_flush_pending_frames+0x1c0/0x340 [ 12.555458] udpv6_destroy_sock+0xfa/0x280 [ 12.556456] sk_common_release+0x65/0x370 [ 12.557501] inet_release+0x109/0x270 [ 12.558522] __sock_release+0xa6/0x260 [ 12.559475] sock_close+0x15/0x20 [ 12.560331] __fput+0x2f7/0x9d0 [ 12.561188] __x64_sys_close+0x7c/0xd0 [ 12.562221] do_syscall_64+0x58/0x120 [ 12.563422] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 12.565122] RIP: 0033:0x41aad4 [ 12.565831] Code: d0 0f 05 48 3d 00 f0 ff ff 76 f3 f7 d8 64 89 06 eb ec 0f 1f 40 00 f3 0f 1e fa 80 3d 8d c5 09 00 00 74 13 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 3c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 7d [ 12.570848] RSP: 002b:00007ffe399fe088 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 [ 12.572320] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000041aad4 [ 12.574150] RDX: 0000000000000000 RSI: 00007ffe399fdee0 RDI: 0000000000000005 [ 12.576095] RBP: 0000000000000000 R08: 000000000000001d R09: 0000000000000000 [ 12.577821] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000257 [ 12.579842] R13: 00007ffe399fecc8 R14: 00000000004b1868 R15: 0000000000000001 [ 12.581780] </TASK> [ 12.582451] Modules linked in: [ 12.583352] ---[ end trace 0000000000000000 ]--- [ 12.584584] RIP: 0010:kfree_skb_list_reason+0x18a/0x610 [ 12.586156] Code: 3c 18 00 0f 85 97 03 00 00 4c 89 7c d4 58 83 f9 10 0f 84 24 02 00 00 48 85 ed 0f 84 33 01 00 00 49 89 ef 4c 89 f8 48 c1 e8 03 <80> 3c 18 00 0f 85 25 03 00 00 4d 8d af dc 00 00 00 be 04 00 00 00 [ 12.592262] RSP: 0018:ffffc90000d47b90 EFLAGS: 00010216 [ 12.593601] RAX: 0008484848484848 RBX: dffffc0000000000 RCX: 0000000000000000 [ 12.595543] RDX: 1ffff11001893159 RSI: 0000000000000002 RDI: ffffc90000d47c68 [ 12.597252] RBP: ffff88800c498ac0 R08: 0000000000000001 R09: fffff94000063d56 [ 12.598934] R10: ffffea000031eab7 R11: 0000000000000008 R12: 0000000000000002 [ 12.600850] R13: 1ffffffff5b8660d R14: ffffc90000d47be0 R15: 0042424242424242 [ 12.602617] FS: 0000000032dfd380(0000) GS:ffff8880be100000(0000) knlGS:0000000000000000 [ 12.605271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.607401] CR2: 0000000000492c7a CR3: 0000000003dfa000 CR4: 0000000000350ef0