[PATCH] net: skmsg: fix NULL pointer dereference in sk_msg_recvmsg()
From: Pranav Tyagi <hidden>
Date: 2025-07-15 08:12:11
Also in:
bpf, linux-kernel-mentees, lkml
Subsystem:
bpf [l7 framework] (sockmap), networking [general], the rest · Maintainers:
John Fastabend, Jakub Sitnicki, Jiayuan Chen, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
A NULL page from sg_page() in sk_msg_recvmsg() can reach __kmap_local_page_prot() and crash the kernel. Add a check for the page before calling copy_page_to_iter() and fail early with -EFAULT to prevent the crash. Reported-by: syzbot+b18872ea9631b5dcef3b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b18872ea9631b5dcef3b Fixes: 2bc793e3272a ("skmsg: Extract __tcp_bpf_recvmsg() and tcp_bpf_wait_data()") Signed-off-by: Pranav Tyagi <redacted> --- net/core/skmsg.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index 4d75ef9d24bf..f5367356a483 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c@@ -432,6 +432,10 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, sge = sk_msg_elem(msg_rx, i); copy = sge->length; page = sg_page(sge); + if (!page) { + copied = copied ? copied : -EFAULT; + goto out; + } if (copied + copy > len) copy = len - copied; copy = copy_page_to_iter(page, sge->offset, copy, iter);
--
2.49.0