net: core: fix head-page leak in skb_zerocopy

When skb_orphan_frags() throws -ENOMEM, skb_copy_ubufs() may have
already reallocated and replaced 'from->head'. Accessing from->head to
drop the old refcount leaks the original head page, and erroneously
puts an unrelated new buffer. Use the local 'page' tracker variable
instead to drop the reference properly.

Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors")
Signed-off-by: Mina Almasry <almasrymina@google.com>
Link: https://patch.msgid.link/20260823183602.1051453-2-almasrymina@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d2583fe..cbbd604 100644 (file)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3910,7 +3910,7 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
        }
 
        if (!skb_frags_readable(from) && j > 0 && len) {
-               put_page(virt_to_head_page(from->head));
+               put_page(page);
                return -EFAULT;
        }
 
@@ -3918,7 +3918,7 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 
        if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
                if (j > 0)
-                       put_page(virt_to_head_page(from->head));
+                       put_page(page);
                return -ENOMEM;
        }
        skb_zerocopy_clone(to, from, GFP_ATOMIC);