Re: [PATCH bpf] bpf: Fix page double free in test_bpf skb setup

[Alexei Starovoitov]

On Thu Sep 17, 2026 at 2:38 AM UTC, Nicholas Dudar wrote:
> build_test_skb() transfers page ownership to an skb with
> skb_add_rx_frag(). If either allocation in the second loop iteration fails,
> kfree_skb() releases page[0], but the error path then falls through and
> frees page[0] again.
>
> Return after freeing skb[0], since page[0] is already owned by the skb at
> that point; the raw page cleanup is only correct for the first iteration.
>
> Fixes: 76db8087c4c9 ("net: bpf: add a test for skb_segment in test_bpf module")
> Assisted-by: Codex:gpt-6-astra
> Signed-off-by: Nicholas Dudar <main.kalliope@xxxxxxxxx>
> ---
> Please queue this fix for stable. The double-free has been present since
> v4.17 and is reachable when the test_bpf skb test encounters an allocation
> failure.

No.
I don't think you have a way to reproduce it.
We don't scream "bug... apply to stable" just because AI found a tiny
race.

pw-bot: cr