diff options
| author | Mina Almasry <almasrymina@google.com> | 2026-08-23 18:36:02 +0000 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-08-25 11:28:44 +0200 |
| commit | 97148bcb751105cd7cf86a21344887028f329890 (patch) | |
| tree | 5c9cd3413cbbd86d11e602d274a14cd992df7a13 /tools/perf/scripts/python | |
| parent | 00e11ee9831b3439264e0ae6762a0470126515af (diff) | |
| download | linux-97148bcb751105cd7cf86a21344887028f329890.tar.gz linux-97148bcb751105cd7cf86a21344887028f329890.zip | |
net: core: fix head-page leak in skb_zerocopy
When skb_orphan_frags() throws -ENOMEM, skb_copy_ubufs() may have
already reallocated and replaced 'from->head'. Accessing from->head to
drop the old refcount leaks the original head page, and erroneously
puts an unrelated new buffer. Use the local 'page' tracker variable
instead to drop the reference properly.
Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors")
Signed-off-by: Mina Almasry <almasrymina@google.com>
Link: https://patch.msgid.link/20260823183602.1051453-2-almasrymina@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions