Re: [PATCH net v1 2/2] net: core: fix head-page leak in skb_zerocopy

[Paolo Abeni]

On 8/23/26 8:36 PM, Mina Almasry wrote:
> When skb_orphan_frags() throws -ENOMEM, skb_copy_ubufs() may have
> already reallocated and replaced 'from->head'. Accessing from->head to
> drop the old refcount leaks the original head page, and erroneously
> puts an unrelated new buffer. Use the local 'page' tracker variable
> instead to drop the reference properly.
> 
> Fixes: 36d5fe6a0007 ("core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors")
> 
> Signed-off-by: Mina Almasry <almasrymina@xxxxxxxxxx>
Note that there must be no empty lines in the tag area; no need to
repost, I'll fix it while applying.

/P