AF_PACKET PACKET_TX_RING transmission over the loopback interface can silently corrupt packet payloads in flight. tpacket_fill_skb() builds the transmit skb using zerocopy frags. loopback_xmit() then calls bare skb_orphan(), which runs skb->destructor (tpacket_destruct_skb()) and marks the ring slot TP_STATUS_AVAILABLE, telling userspace the buffer is reusable while the in-flight skb frags still reference that buffer. This is ok if the packet gets processed immediately in loopback's xmit path before userspace gets a chance to reuse the frag buffer. However, if the packet gets redirected for instance to another CPU (via RPS), this opens a window where userspace may already write new data into the frag buffer before the receiver reads the original content. Reproducer using txring_overwrite from the net:run_afpackettests selftest: ip netns add ns && ip -netns ns link set lo up ip netns exec ns sh -c \ 'echo 100 > /sys/class/net/lo/queues/rx-0/rps_cpus' taskset -c 0 ip netns exec ns ./txring_overwrite Commit 5cd8d46ea156 ("packet: copy user buffers before orphan or clone") is meant to trigger this copy from the skb_orphan_frags{_rx}() call sites, but loopback_xmit() calls bare skb_orphan() before any of them run. Address this by taking a kernel-private copy of the skb frags before going down the receive path. Fixes: 5cd8d46ea156 ("packet: copy user buffers before orphan or clone") Cc: stable@vger.kernel.org Signed-off-by: Bjoern Doebel Assisted-by: Kiro:claude-opus-5 --- Verified that the reproducer in the commit message fails 100% right now and no longer fails after the patch. --- drivers/net/loopback.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c index 1fb6ce6843ade..31ae10a9d7911 100644 --- a/drivers/net/loopback.c +++ b/drivers/net/loopback.c @@ -72,6 +72,23 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb, { int len; + /* The skb_orphan() below will run the skb's destructor, which + * for AF_PACKET TX-ring senders marks the slot as TP_STATUS_AVAILABLE + * again, even though it still has zerocopy frags pointing to it that + * will only be copied later in the receive path's + * skb_orphan_frags_rx(). As such, if the receive path gets deferred, + * for example by RPS steering the packet to another CPU, this creates + * a race where userspace may fill in new data into the frag before the + * old data gets copied out. + * + * Take a kernel-private copy. + */ + if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC))) { + dev_core_stats_tx_dropped_inc(dev); + kfree_skb_reason(skb, SKB_DROP_REASON_SKB_UCOPY_FAULT); + return NETDEV_TX_OK; + } + skb_tx_timestamp(skb); /* do not fool net_timestamp_check() with various clock bases */ -- 2.50.1