lcfr-eth

/*
 * gro_frag.c — LPE via GRO managed-frag UAF (io_uring SEND_ZC + veth)
 *
 * The bug: skb_gro_receive() copies frag descriptors from a ZC skb
 * (SKBFL_MANAGED_FRAG_REFS → no per-frag page refs) into a non-ZC
 * GRO accumulator.  When the accumulator is freed, skb_release_data()
 * calls put_page() on each frag — including the stolen ones that never
 * had get_page() called.  This gives us one extra put_page per merged
 * ZC frag: a refcount underflow.
 *