* [PATCH net v3] net: fix memory leak in skb_segment_list for GRO packets
@ 2026-01-04 21:31 mheib
2026-01-05 19:34 ` Willem de Bruijn
2026-01-06 1:10 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: mheib @ 2026-01-04 21:31 UTC (permalink / raw)
To: netdev
Cc: willemdebruijn.kernel, davem, edumazet, kuba, pabeni, horms,
kernelxing, kuniyu, atenart, aleksander.lobakin, Mohammad Heib
From: Mohammad Heib <mheib@redhat•com>
When skb_segment_list() is called during packet forwarding, it handles
packets that were aggregated by the GRO engine.
Historically, the segmentation logic in skb_segment_list assumes that
individual segments are split from a parent SKB and may need to carry
their own socket memory accounting. Accordingly, the code transfers
truesize from the parent to the newly created segments.
Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this
truesize subtraction in skb_segment_list() was valid because fragments
still carry a reference to the original socket.
However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed
this behavior by ensuring that fraglist entries are explicitly
orphaned (skb->sk = NULL) to prevent illegal orphaning later in the
stack. This change meant that the entire socket memory charge remained
with the head SKB, but the corresponding accounting logic in
skb_segment_list() was never updated.
As a result, the current code unconditionally adds each fragment's
truesize to delta_truesize and subtracts it from the parent SKB. Since
the fragments are no longer charged to the socket, this subtraction
results in an effective under-count of memory when the head is freed.
This causes sk_wmem_alloc to remain non-zero, preventing socket
destruction and leading to a persistent memory leak.
The leak can be observed via KMEMLEAK when tearing down the networking
environment:
unreferenced object 0xffff8881e6eb9100 (size 2048):
comm "ping", pid 6720, jiffies 4295492526
backtrace:
kmem_cache_alloc_noprof+0x5c6/0x800
sk_prot_alloc+0x5b/0x220
sk_alloc+0x35/0xa00
inet6_create.part.0+0x303/0x10d0
__sock_create+0x248/0x640
__sys_socket+0x11b/0x1d0
Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST
packets constructed by GRO, the truesize adjustment is removed.
The call to skb_release_head_state() must be preserved. As documented in
commit cf673ed0e057 ("net: fix fraglist segmentation reference count
leak"), it is still required to correctly drop references to SKB
extensions that may be overwritten during __copy_skb_header().
Fixes: ed4cccef64c1 ("gro: fix ownership transfer")
Signed-off-by: Mohammad Heib <mheib@redhat•com>
---
v3:
- Completely removed delta_truesize tracking.
- Added DEBUG_NET_WARN_ON_ONCE assertions.
- Updated commit message with historical context, KMEMLEAK trace, and
clarification on why skb_release_head_state() is preserved.
v2:
- Updated Fixes tag.
---
net/core/skbuff.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a00808f7be6a..a56133902c0d 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4636,12 +4636,14 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
{
struct sk_buff *list_skb = skb_shinfo(skb)->frag_list;
unsigned int tnl_hlen = skb_tnl_header_len(skb);
- unsigned int delta_truesize = 0;
unsigned int delta_len = 0;
struct sk_buff *tail = NULL;
struct sk_buff *nskb, *tmp;
int len_diff, err;
+ /* Only skb_gro_receive_list generated skbs arrive here */
+ DEBUG_NET_WARN_ON_ONCE(!(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST));
+
skb_push(skb, -skb_network_offset(skb) + offset);
/* Ensure the head is writeable before touching the shared info */
@@ -4655,8 +4657,9 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
nskb = list_skb;
list_skb = list_skb->next;
+ DEBUG_NET_WARN_ON_ONCE(nskb->sk);
+
err = 0;
- delta_truesize += nskb->truesize;
if (skb_shared(nskb)) {
tmp = skb_clone(nskb, GFP_ATOMIC);
if (tmp) {
@@ -4699,7 +4702,6 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb,
goto err_linearize;
}
- skb->truesize = skb->truesize - delta_truesize;
skb->data_len = skb->data_len - delta_len;
skb->len = skb->len - delta_len;
--
2.52.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net v3] net: fix memory leak in skb_segment_list for GRO packets
2026-01-04 21:31 [PATCH net v3] net: fix memory leak in skb_segment_list for GRO packets mheib
@ 2026-01-05 19:34 ` Willem de Bruijn
2026-01-06 1:10 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Willem de Bruijn @ 2026-01-05 19:34 UTC (permalink / raw)
To: mheib, netdev
Cc: willemdebruijn.kernel, davem, edumazet, kuba, pabeni, horms,
kernelxing, kuniyu, atenart, aleksander.lobakin, Mohammad Heib
mheib@ wrote:
> From: Mohammad Heib <mheib@redhat•com>
>
> When skb_segment_list() is called during packet forwarding, it handles
> packets that were aggregated by the GRO engine.
>
> Historically, the segmentation logic in skb_segment_list assumes that
> individual segments are split from a parent SKB and may need to carry
> their own socket memory accounting. Accordingly, the code transfers
> truesize from the parent to the newly created segments.
>
> Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this
> truesize subtraction in skb_segment_list() was valid because fragments
> still carry a reference to the original socket.
>
> However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed
> this behavior by ensuring that fraglist entries are explicitly
> orphaned (skb->sk = NULL) to prevent illegal orphaning later in the
> stack. This change meant that the entire socket memory charge remained
> with the head SKB, but the corresponding accounting logic in
> skb_segment_list() was never updated.
>
> As a result, the current code unconditionally adds each fragment's
> truesize to delta_truesize and subtracts it from the parent SKB. Since
> the fragments are no longer charged to the socket, this subtraction
> results in an effective under-count of memory when the head is freed.
> This causes sk_wmem_alloc to remain non-zero, preventing socket
> destruction and leading to a persistent memory leak.
>
> The leak can be observed via KMEMLEAK when tearing down the networking
> environment:
>
> unreferenced object 0xffff8881e6eb9100 (size 2048):
> comm "ping", pid 6720, jiffies 4295492526
> backtrace:
> kmem_cache_alloc_noprof+0x5c6/0x800
> sk_prot_alloc+0x5b/0x220
> sk_alloc+0x35/0xa00
> inet6_create.part.0+0x303/0x10d0
> __sock_create+0x248/0x640
> __sys_socket+0x11b/0x1d0
>
> Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST
> packets constructed by GRO, the truesize adjustment is removed.
>
> The call to skb_release_head_state() must be preserved. As documented in
> commit cf673ed0e057 ("net: fix fraglist segmentation reference count
> leak"), it is still required to correctly drop references to SKB
> extensions that may be overwritten during __copy_skb_header().
>
> Fixes: ed4cccef64c1 ("gro: fix ownership transfer")
> Signed-off-by: Mohammad Heib <mheib@redhat•com>
Reviewed-by: Willem de Bruijn <willemb@google•com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net v3] net: fix memory leak in skb_segment_list for GRO packets
2026-01-04 21:31 [PATCH net v3] net: fix memory leak in skb_segment_list for GRO packets mheib
2026-01-05 19:34 ` Willem de Bruijn
@ 2026-01-06 1:10 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2026-01-06 1:10 UTC (permalink / raw)
To: mohammad heib
Cc: netdev, willemdebruijn.kernel, davem, edumazet, kuba, pabeni,
horms, kernelxing, kuniyu, atenart, aleksander.lobakin
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel•org>:
On Sun, 4 Jan 2026 23:31:01 +0200 you wrote:
> From: Mohammad Heib <mheib@redhat•com>
>
> When skb_segment_list() is called during packet forwarding, it handles
> packets that were aggregated by the GRO engine.
>
> Historically, the segmentation logic in skb_segment_list assumes that
> individual segments are split from a parent SKB and may need to carry
> their own socket memory accounting. Accordingly, the code transfers
> truesize from the parent to the newly created segments.
>
> [...]
Here is the summary with links:
- [net,v3] net: fix memory leak in skb_segment_list for GRO packets
https://git.kernel.org/netdev/net/c/238e03d04662
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-01-06 1:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-04 21:31 [PATCH net v3] net: fix memory leak in skb_segment_list for GRO packets mheib
2026-01-05 19:34 ` Willem de Bruijn
2026-01-06 1:10 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox