github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: skbuff: don't BUG() on a missing head_frag in skb_zerocopy()

Browse Source 
skb_zerocopy() BUG()s if @from has no head_frag and the caller passed
hlen == 0, meaning the caller didn't ask for the head to be copied and
the head can't be referenced as a page either.  The check runs before
anything is touched, and skb_zerocopy() already documents -EFAULT for
bad skb geometry.  Return that, with a DEBUG_NET_WARN_ON_ONCE() for
debug kernels.

Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Link: https://patch.msgid.link/20261007-b4-skbuff-bug-on-v2-7-b9a5f732895b@toxicpanda.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Josef Bacik 2026-10-07 17:36:06 +00:00 committed by Jakub Kicinski
parent 417261779e
commit 433380f5ab
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/core/skbuff.c
View File

@ -3917,7 +3917,10 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
struct page *page;
unsigned int offset;
BUG_ON(!from->head_frag && !hlen);
if (unlikely(!from->head_frag && !hlen)) {
DEBUG_NET_WARN_ON_ONCE(1);
return -EFAULT;
}
/* dont bother with small payloads */
if (len <= skb_tailroom(to))