From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-221.mail.qq.com (out203-205-221-221.mail.qq.com [203.205.221.221]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D5C7B2DE6FC for ; Fri, 28 Nov 2025 07:55:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.221 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764316555; cv=none; b=DPGIEeEHocUuGu1RS22z8z2O9FhbejYij+Pzm/pifmA8SFMD4ZFnRlJwU9bVEnzKceT30zxEKn/lJ2c6FwjKOogQgExA342BwGbg8nFulfScufQHgUaYgGGXK+bs25Q/4AhD3V3y8Tye2LoAafQt7CTePgdnxu6iFJnvuJGDrvk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764316555; c=relaxed/simple; bh=nbMY+C8B7Sx6+FoLkH2uNtczrgimCSfvZ1+U71eoYxA=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=aysZAxFX4pU+0wcR7drmi6fULtaWHtsBcc2qhZ6nGxNA8IxiV+lB1znupHkrtUj2aqXt9/Nz5fLS9P39FKOdZ92vmYCBHHjrbgf7Oj1jzYU42W5Rr31PnBFXeVFR1hxf0QImZmNbLKzA8oRPk5nZumfho12GYMwE2+3mEmjffwY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=WsIQN96h; arc=none smtp.client-ip=203.205.221.221 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="WsIQN96h" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1764316550; bh=JzRhEMzmu4bOmhe7MeQfjYevALjbbjNFXR/kXxN/HbE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=WsIQN96hpfG9hlzIlub+AcatL+nOHsUtr72oTUgjIom0f8p16uzZSILu47kkj+uvL 8C5dULu19/vnro+ByfSphD7HZzM4qH3ya7p6FgFWwAkV7pT/kjWcN0iNOL87AxKMQE GUz0L4CfX3XwmXZsUSZzjvSRD+cFYMWaVjt0Bnh0= Received: from lxu-ped-host.. ([111.201.7.117]) by newxmesmtplogicsvrszc43-0.qq.com (NewEsmtp) with SMTP id DF01AA2E; Fri, 28 Nov 2025 15:55:48 +0800 X-QQ-mid: xmsmtpt1764316548t3c9bs9uw Message-ID: X-QQ-XMAILINFO: MpYZqmNm/7vMNHeJTqo8aa3a1pcwav/fL4x7AewxbE3eyXayM66zy/ULNE84se GpHxv8o3ETPZ+DuylKETuWCAz/dj8GRys7BBsKbgX54KmPffylD3q0mRLPfxZhwkiCeJrh3olfFL E85U4hr671iWVrx+SGW1qozMKWWL+JWSy9w8KhT+8tvokr+lcmcTnxY4Dv3tH8qXtzlQlvk8cKj1 w4LiOARcrdJZVNauolYyzcLTQlpN4RzXFM+NYpNaiMzEbA0OAR7zBF6e5JW9EUNVuMAZHS4jKcIY htWYFcwAlyxcpoFHHQTNRsCkPa2908iBtkTP8HOO0Zi2XOOoPKEnhMGPePF7pCzKI01E0wkHFTES Jj8L5m8WC8CMLVnv69BwzJr/UJJplOIDD3BMH1fp1srlpKJ/2y7TVghCpcCae5P2CAeLmOO8v3gD hUp8/PB77Gu4mpVZopxyPCxroWd0k4EDcRoxA9JRFq+b7eWGmbteUF3JvJMZsbQKgSs7zfOBN5x8 DukfdZJ525uVKh9svfYgW87HdCnUV5G0/V+LUJcLFxMzA21iNJIcsR+Kif4NlzW2uzZ+iVpczmnU BqUwX+4f8wTueXztQrlvKU6ef+eXqBP0g0R9zBRBhr2xDNHDrTo6qWtlZiK7879QqoPhJlKNHYes 3VOI0wQLJDG9QBR25GBv7GFN4UxzNbql5uRUJhZ4XBax3E5s9sXBr1nGMMjf+VZi4MDWDht6Ni5H 8bFylAO+PB4SmWuGrPuDm0AzRalZI6LHnHRcyGFthAAiybJOoGBmChULbGq7QCXPIKvWybO+gBEX txpjVr9i0kVEYRr4ui/UJgKZE3FGOokgb1F8m+cdQyJWym8ffi7d6PNdFBcsjLNpYqgys8bjACs+ A+S1Rz2/0GogSwnnPzuAjln4B/YdRj+VzMbDR1Uw93uAW1ZK8aD4ZxAyU6p0hkjWQN4V7OVpwZxk ux7TYfV3nNSmEOw5TcVGKC1HcUtmpziElu7CoE8+Y= X-QQ-XMRINFO: Nq+8W0+stu50PRdwbJxPCL0= From: Edward Adam Davis To: syzbot+28e5f3d207b14bae122a@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [kvm?] [net?] [virt?] WARNING in virtio_transport_send_pkt_info (2) Date: Fri, 28 Nov 2025 15:55:49 +0800 X-OQ-MSGID: <20251128075548.107480-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <6928fe78.a70a0220.d98e3.012a.GAE@google.com> References: <6928fe78.a70a0220.d98e3.012a.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/net/core/datagram.c b/net/core/datagram.c index c285c6465923..db253fd890d7 100644 --- a/net/core/datagram.c +++ b/net/core/datagram.c @@ -636,6 +636,8 @@ int zerocopy_fill_skb_from_iter(struct sk_buff *skb, struct iov_iter *from, size_t length) { int frag = skb_shinfo(skb)->nr_frags; + int err; + size_t len = length; if (!skb_frags_readable(skb)) return -EFAULT; @@ -647,13 +649,17 @@ int zerocopy_fill_skb_from_iter(struct sk_buff *skb, size_t start; ssize_t copied; - if (frag == MAX_SKB_FRAGS) - return -EMSGSIZE; + if (frag == MAX_SKB_FRAGS) { + err = -EMSGSIZE; + goto fault; + } copied = iov_iter_get_pages2(from, pages, length, MAX_SKB_FRAGS - frag, &start); - if (copied < 0) - return -EFAULT; + if (copied < 0) { + err = -EFAULT; + goto fault; + } length -= copied; @@ -701,6 +707,9 @@ int zerocopy_fill_skb_from_iter(struct sk_buff *skb, page_ref_sub(last_head, refs); } return 0; +fault: + iov_iter_revert(from, len - length); + return err; } static int