Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

skbuff: fix coalescing for page_pool fragment recycling

Fix a use-after-free when using page_pool with page fragments. We encountered this problem during normal RX in the hns3 driver:

(1) Initially we have three descriptors in the RX queue. The first one allocates PAGE1 through page_pool, and the other two allocate one half of PAGE2 each. Page references look like this:

RX_BD1 _______ PAGE1 RX_BD2 _______ PAGE2 RX_BD3 _________/

(2) Handle RX on the first descriptor. Allocate SKB1, eventually added to the receive queue by tcp_queue_rcv().

(3) Handle RX on the second descriptor. Allocate SKB2 and pass it to netif_receive_skb():

netif_receive_skb(SKB2) ip_rcv(SKB2) SKB3 = skb_clone(SKB2)

SKB2 and SKB3 share a reference to PAGE2 through skb_shinfo()->dataref. The other ref to PAGE2 is still held by RX_BD3:

SKB2 ---+- PAGE2 SKB3 __/ / RX_BD3 _________/

(3b) Now while handling TCP, coalesce SKB3 with SKB1:

tcp_v4_rcv(SKB3) tcp_try_coalesce(to=SKB1, from=SKB3) // succeeds kfree_skb_partial(SKB3) skb_release_data(SKB3) // drops one dataref

SKB1 _____ PAGE1 \____ SKB2 _____ PAGE2 / R…