Commit 238e03d0 authored by Mohammad Heib's avatar Mohammad Heib Committed by Jakub Kicinski
Browse files

net: fix memory leak in skb_segment_list for GRO packets 



When skb_segment_list() is called during packet forwarding, it handles
packets that were aggregated by the GRO engine.

Historically, the segmentation logic in skb_segment_list assumes that
individual segments are split from a parent SKB and may need to carry
their own socket memory accounting. Accordingly, the code transfers
truesize from the parent to the newly created segments.

Prior to commit ed4cccef ("gro: fix ownership transfer"), this
truesize subtraction in skb_segment_list() was valid because fragments
still carry a reference to the original socket.

However, commit ed4cccef ("gro: fix ownership transfer") changed
this behavior by ensuring that fraglist entries are explicitly
orphaned (skb->sk = NULL) to prevent illegal orphaning later in the
stack. This change meant that the entire socket memory charge remained
with the head SKB, but the corresponding accounting logic in
skb_segment_list() was never updated.

As a result, the current code unconditionally adds each fragment's
truesize to delta_truesize and subtracts it from the parent SKB. Since
the fragments are no longer charged to the socket, this subtraction
results in an effective under-count of memory when the head is freed.
This causes sk_wmem_alloc to remain non-zero, preventing socket
destruction and leading to a persistent memory leak.

The leak can be observed via KMEMLEAK when tearing down the networking
environment:

unreferenced object 0xffff8881e6eb9100 (size 2048):
  comm "ping", pid 6720, jiffies 4295492526
  backtrace:
    kmem_cache_alloc_noprof+0x5c6/0x800
    sk_prot_alloc+0x5b/0x220
    sk_alloc+0x35/0xa00
    inet6_create.part.0+0x303/0x10d0
    __sock_create+0x248/0x640
    __sys_socket+0x11b/0x1d0

Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST
packets constructed by GRO, the truesize adjustment is removed.

The call to skb_release_head_state() must be preserved. As documented in
commit cf673ed0 ("net: fix fraglist segmentation reference count
leak"), it is still required to correctly drop references to SKB
extensions that may be overwritten during __copy_skb_header().

Fixes: ed4cccef ("gro: fix ownership transfer")
Signed-off-by: default avatarMohammad Heib <mheib@redhat.com>
Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260104213101.352887-1-mheib@redhat.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 86c22d47

net/core/skbuff.c

+5 −3
Original line number Diff line number Diff line
@@ -4636,12 +4636,14 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, 
{

	struct sk_buff *list_skb = skb_shinfo(skb)->frag_list;

	unsigned int tnl_hlen = skb_tnl_header_len(skb);

	unsigned int delta_truesize = 0;

	unsigned int delta_len = 0;

	struct sk_buff *tail = NULL;

	struct sk_buff *nskb, *tmp;

	int len_diff, err;



	/* Only skb_gro_receive_list generated skbs arrive here */

	DEBUG_NET_WARN_ON_ONCE(!(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST));



	skb_push(skb, -skb_network_offset(skb) + offset);



	/* Ensure the head is writeable before touching the shared info */
@@ -4655,8 +4657,9 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, 
		nskb = list_skb;

		list_skb = list_skb->next;



		DEBUG_NET_WARN_ON_ONCE(nskb->sk);



		err = 0;

		delta_truesize += nskb->truesize;

		if (skb_shared(nskb)) {

			tmp = skb_clone(nskb, GFP_ATOMIC);

			if (tmp) {
@@ -4699,7 +4702,6 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, 
			goto err_linearize;

	}



	skb->truesize = skb->truesize - delta_truesize;

	skb->data_len = skb->data_len - delta_len;

	skb->len = skb->len - delta_len;