From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 849D833557C for ; Tue, 17 Feb 2026 11:52:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771329180; cv=none; b=MeW9Enmzil+qGb7WZZShkp52lcpmcl5l9gRmVQM4bfm8xOs9D2moDJ2mwAWGifwfOu08EV/e3PJkIOJD1MmDsZagiTQMtMmLFqP1/tqn87CuyHLlEvgNH7gzxp/ha+bls7j3o4HCFQFxIpSKf1a583QlvvzT/3FvJVT8gJhWwS4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771329180; c=relaxed/simple; bh=ER8QX+29neCE9t2GHfNO2d85s/NYfHvQ5IK6I4DYo+4=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=H7iDBeSj+A5fEbNXg/2cCLKSrIUW/SxAQRSma/hDl2lOqBuErQ6dyjxd3aeChqBcPf85s2+xmogXNTqdAalZQidnIjR140BAh1ckgJjG5TgfnkhQx373HTtFRc7D2g3OuESWkY73GwQtHJiITHdp7zNFPYkJGh9adYaSfQP2EHw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=LoHIYxUW; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=U7SRGoSs; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="LoHIYxUW"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="U7SRGoSs" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1771329178; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ZeZjW0ch267D5Cb5shXKk8QktbPL84wmInr+pQHHSrA=; b=LoHIYxUWCGvjWFeRIFsp8lcfViNQn7iIrnfcGrQVhUrWMPxCTVN+k/ZIEWUYCqzgYq0V1/ 2CJPQsNYThRcvZ8y9JzqkecpohRx/DGz/JVXJLrYC08692QhzhyjdO6q3oevOttqKH0jXF 4vFvATP7wxQtVYSZZpOAO5JeCjTkDUM= Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-619-saYzqWHtM8G8-WmTGCZP6g-1; Tue, 17 Feb 2026 06:52:55 -0500 X-MC-Unique: saYzqWHtM8G8-WmTGCZP6g-1 X-Mimecast-MFC-AGG-ID: saYzqWHtM8G8-WmTGCZP6g_1771329174 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-43771113b3bso3207831f8f.0 for ; Tue, 17 Feb 2026 03:52:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1771329174; x=1771933974; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=ZeZjW0ch267D5Cb5shXKk8QktbPL84wmInr+pQHHSrA=; b=U7SRGoSsxLrra//FR0GMZsDOq8w5oql5ozFwezZmPvA0Vg0Nt3ImG9+J+vxoQjzgN/ Dv9iZIJsPtSPTwV3h9tcnVZT9pHTvEk+em/ZFFoFMXSGSpI+k4N1VE131MXH6S+yOCAt IxBluMqmu0xRMVAQGemkZBZa7VBNHnZo5wzubM4b5ZUHpa2yjSXfwJRcxFMKfLYu/ahL qCro208bLaFc+tKnI3CFw78D/h9BPPxVTSCf7yKI9x3vjn3hQxH78OA15KTDGGBJ7SIX des4qgTKQ+SBZEFISMTEVZdNB3zYBLOMtuxL2/cFGrccJkMcdbgkl+EBgR5jMv4PMggL 77rQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771329174; x=1771933974; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=ZeZjW0ch267D5Cb5shXKk8QktbPL84wmInr+pQHHSrA=; b=R0LcyUXiABTFwC6LtiT3WQavRYWTKiPw3je6RsUAa/XLy/7ipMgqPZPhxdirRbamnM 642LoiyLmRO09iqfl+VO8eVQ37kjKYQgh8Ec2iutCwX5mpgTcQlvzYKEj7MQ8T8aW2si jHbw7aC8rqMv+sx80h9qUIuQ8xJDv31EUVAa1yrbu2cKVDZVRj40l3Y4brfFzTEPciWY Ja3pxiA9V6VyuYyHhK1t8N+X/H6J8kADwnaqBB+uj9MH8mqgdPNf1kEeNDR6EBI7xA/E IUX0UM3NFgygBT0Ln7BpBWpLXXIT2J+Q/HVlE0GJNUnTyZ8lQ5Dj950dtPj9OtDh1V05 Gfyg== X-Forwarded-Encrypted: i=1; AJvYcCVcogQjIouFHwkeGccmnhssULK6xgBEukrMItEZWOIh/ilp+waxnihCH/ZmTjb/Nem61zviSA16rqW9zzw=@vger.kernel.org X-Gm-Message-State: AOJu0YwI5FED4fE8uLYoadNJ3I5dN0cApQVD429K3M4cZT1mXJzOns2u hv9110Xo+BEb+ebKEdNhduzwgoHZn5rX0FunTHvJlCOquZhin/JPl14LeR/9HPM22HGYOJaFQcm vhdyqAUWjTxs7FVAq7UiE2yfmAoJ6utYXVPHonGGXxqAqyQdeP8aeM8/8MyKutQ5KhQ== X-Gm-Gg: AZuq6aIUgG/v9GKaU5Y87czjjcuF7isJiKDFw01lAVsaq16Uyx704Ho2EiB5NB1t5uK Z5ZkhHJejFq3h0O4V2Hqf3GQ1aIplJR8YsM1aVExXfd9Sf4AxSwyMGFGdD3xv1OPTkdTVm2KE68 crgXd6v6U/YuMaonUwItvzP/SoTSk41TP5y2L3mKAD4F0wZC/8gBUuONShtgzia6qoLgZGaN643 ryANlVrLsESR52LBAvbggACzPXZ5Kx+aVzsaQsZ/c8KF0ss7IFS5nM0xofChPNscuMrK6cpifO+ OONbTJyTWP04DUD4Bzhqgj5xR8PudWjo2q95UYrceyIem5rtkC2sJFXtmnmll/zJbOPL9twBl9y Mrp19jn+94eN7rn7fOojWiLvoPQ== X-Received: by 2002:a05:6000:2585:b0:436:3475:473e with SMTP id ffacd0b85a97d-4379791ad09mr24193744f8f.51.1771329173990; Tue, 17 Feb 2026 03:52:53 -0800 (PST) X-Received: by 2002:a05:6000:2585:b0:436:3475:473e with SMTP id ffacd0b85a97d-4379791ad09mr24193704f8f.51.1771329173517; Tue, 17 Feb 2026 03:52:53 -0800 (PST) Received: from [192.168.88.32] ([169.155.232.137]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43796ad015bsm35047046f8f.38.2026.02.17.03.52.52 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 17 Feb 2026 03:52:52 -0800 (PST) Message-ID: <404e29e1-a5b8-4d43-bde6-7409a8b00b57@redhat.com> Date: Tue, 17 Feb 2026 12:52:51 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH net v1] kcm: fix zero-frag skb in frag_list on partial sendmsg error To: Jiayuan Chen , netdev@vger.kernel.org Cc: Jiayuan Chen , syzbot+52624bdfbf2746d37d70@syzkaller.appspotmail.com, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Simon Horman , Michal Luczaj , Sven Stegemann , Christian Brauner , Tom Herbert , linux-kernel@vger.kernel.org References: <20260213061232.338244-1-jiayuan.chen@linux.dev> Content-Language: en-US From: Paolo Abeni In-Reply-To: <20260213061232.338244-1-jiayuan.chen@linux.dev> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 2/13/26 7:12 AM, Jiayuan Chen wrote: > From: Jiayuan Chen > > Syzkaller reported a warning in kcm_write_msgs() when processing a > message with a zero-fragment skb in the frag_list. > > When kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb, > it allocates a new skb (tskb) and links it into the frag_list before > copying data. If the copy subsequently fails (e.g. -EFAULT from > user memory), tskb remains in the frag_list with zero fragments: > > head skb (msg being assembled, NOT yet in sk_write_queue) > +-----------+ > | frags[17] | (MAX_SKB_FRAGS, all filled with data) > | frag_list-+--> tskb > +-----------+ +----------+ > | frags[0] | (empty! copy failed before filling) > +----------+ > > For SOCK_SEQPACKET with partial data already copied, the error path > saves this message via partial_message for later completion. A > subsequent zero-length write(fd, NULL, 0) implies MSG_EOR, which > queues the message to sk_write_queue. AI review noted that the above statement is dubious. Specifically, looking it looks like that write(fd, NULL, 0) implies EOR for SOCK_DGRAM packets: int eor = (sock->type == SOCK_DGRAM) ? !(msg->msg_flags & MSG_MORE) : !!(msg->msg_flags & MSG_EOR); I guess the changelog needs some clarification. Thanks, Paolo