From: Norbert Szetei <norbert@doyensec.com> mainline inclusion from mainline-v7.3-rc1 commit 8ece906150128d5ec2462aabcc978c568433eca4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19120 CVE: CVE-2026-90049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- skb_zerocopy() copies frags from @from into @to. On an skb_orphan_frags() failure it calls skb_tx_error(@from), a destructive operation on the source skb the copy helper does not own. That completes @from's zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the SKBFL_SHARED_FRAG page-ownership marker. Both callers already report the failure on their own drop path. nfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in the flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by dropping it here. On Open vSwitch's OVS_ACTION_ATTR_USERSPACE path the skb is not freed on this error: do_execute_actions() ignores output_userspace()'s return value and, unless the upcall was the last action, keeps forwarding the same skb through the flow's remaining actions. The uarg is completed while that skb is still in flight, telling the producer its buffers are free, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack still handles. That flag is what makes esp_input() call skb_cow_data() instead of decrypting in place, so a later local ESP delivery can decrypt over frags the skb does not own privately. Leave error reporting to the callers. Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors") Cc: stable@vger.kernel.org Suggested-by: Ilya Maximets <i.maximets@ovn.org> Signed-off-by: Norbert Szetei <norbert@doyensec.com> Reviewed-by: Ilya Maximets <i.maximets@ovn.org> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/6E3A780D-FB87-421F-9964-B1D457D7D106@doyensec.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Conflicts: net/core/skbuff.c [Commit 68d8c6532659 ("net: core: propagate unreadable flag in skb_zerocopy") is not present in this tree, so only the removal of skb_tx_error(from) was applied; the j > 0 put_page() cleanup added by that later commit is not part of this fix and was not introduced.] Signed-off-by: JiangJieHua <jiangjiehua1@huawei.com> --- net/core/skbuff.c | 1 - 1 file changed, 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 49f0b680ab8a0..17594aa4124d7 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2829,7 +2829,6 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) to->data_len += len + plen; if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) { - skb_tx_error(from); return -ENOMEM; } skb_zerocopy_clone(to, from, GFP_ATOMIC); -- 2.33.8