kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
No description
1,326,227 commits 117 branches 5,824 tags 6.2 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Jiayuan Chen 9ea3671d70 kcm: fix zero-frag skb in frag_list on partial sendmsg error 
[ Upstream commit ca220141fa ]

Syzkaller reported a warning in kcm_write_msgs() when processing a
message with a zero-fragment skb in the frag_list.

When kcm_sendmsg() fills MAX_SKB_FRAGS fragments in the current skb,
it allocates a new skb (tskb) and links it into the frag_list before
copying data. If the copy subsequently fails (e.g. -EFAULT from
user memory), tskb remains in the frag_list with zero fragments:

  head skb (msg being assembled, NOT yet in sk_write_queue)
  +-----------+
  | frags[17] |  (MAX_SKB_FRAGS, all filled with data)
  | frag_list-+--> tskb
  +-----------+    +----------+
                   | frags[0] |  (empty! copy failed before filling)
                   +----------+

For SOCK_SEQPACKET with partial data already copied, the error path
saves this message via partial_message for later completion. For
SOCK_SEQPACKET, sock_write_iter() automatically sets MSG_EOR, so a
subsequent zero-length write(fd, NULL, 0) completes the message and
queues it to sk_write_queue. kcm_write_msgs() then walks the
frag_list and hits:

  WARN_ON(!skb_shinfo(skb)->nr_frags)

TCP has a similar pattern where skbs are enqueued before data copy
and cleaned up on failure via tcp_remove_empty_skb(). KCM was
missing the equivalent cleanup.

Fix this by tracking the predecessor skb (frag_prev) when allocating
a new frag_list entry. On error, if the tail skb has zero frags,
use frag_prev to unlink and free it in O(1) without walking the
singly-linked frag_list. frag_prev is safe to dereference because
the entire message chain is only held locally (or in kcm->seq_skb)
and is not added to sk_write_queue until MSG_EOR, so the send path
cannot free it underneath us.

Also change the WARN_ON to WARN_ON_ONCE to avoid flooding the log
if the condition is somehow hit repeatedly.

There are currently no KCM selftests in the kernel tree; a simple
reproducer is available at [1].

[1] https://gist.github.com/mrpre/a94d431c757e8d6f168f4dd1a3749daa

Reported-by: syzbot+52624bdfbf2746d37d70@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000269a1405a12fdc77@google.com/T/
Fixes: ab7ac4eb98 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Link: https://patch.msgid.link/20260219014256.370092-1-jiayuan.chen@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-03-04 07:21:33 -05:00
arch arm64: hugetlbpage: avoid unused-but-set-parameter warning (gcc-16) 2026-03-04 07:21:30 -05:00
block block: decouple secure erase size limit from discard size limit 2026-03-04 07:20:56 -05:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec 2026-01-30 10:28:39 +01:00
Documentation ASoC: dt-bindings: asahi-kasei,ak5558: Fix the supply names 2026-03-04 07:20:48 -05:00
drivers Bluetooth: hci_qca: Cleanup on all setup failures 2026-03-04 07:21:33 -05:00
fs btrfs: replace BUG() with error handling in __btrfs_balance() 2026-03-04 07:21:29 -05:00
include Bluetooth: L2CAP: Fix result of L2CAP_ECRED_CONN_RSP when MTU is too short 2026-03-04 07:21:32 -05:00
init init: handle bootloader identifier in kernel parameters 2025-10-19 16:33:50 +02:00
io_uring io_uring/cancel: de-unionize file and user_data in struct io_cancel_data 2026-03-04 07:20:34 -05:00
ipc ipc: don't audit capability check in ipc_permissions() 2026-03-04 07:20:07 -05:00
kernel Remove WARN_ALL_UNSEEDED_RANDOM kernel config option 2026-03-04 07:21:32 -05:00
lib Remove WARN_ALL_UNSEEDED_RANDOM kernel config option 2026-03-04 07:21:32 -05:00
LICENSES LICENSES: add 0BSD license text 2024-09-01 20:43:24 -07:00
mm mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather 2026-02-19 16:29:55 +01:00
net kcm: fix zero-frag skb in frag_list on partial sendmsg error 2026-03-04 07:21:33 -05:00
rust rust: rbtree: fix documentation typo in CursorMut peek_next method 2026-02-06 16:55:44 +01:00
samples samples/ftrace: Adjust LoongArch register restore order in direct calls 2026-01-08 10:14:50 +01:00
scripts modpost: Amend ppc64 save/restfpr symnames for -Os build 2026-03-04 07:21:09 -05:00
security apparmor: fix aa_label to return state from compount and component match 2026-03-04 07:20:41 -05:00
sound ALSA: usb-audio: Add sanity check for OOB writes at silencing 2026-03-04 07:21:29 -05:00
tools tools/power cpupower: Reset errno before strtoull() 2026-03-04 07:20:53 -05:00
usr kbuild: uapi: Strip comments before size type check 2025-11-13 15:34:35 -05:00
virt KVM: Don't clobber irqfd routing type when deassigning irqfd 2026-02-11 13:40:17 +01:00
.clang-format clang-format: Update with v6.11-rc1's for_each macro list 2024-08-02 13:20:31 +02:00
.clippy.toml rust: give Clippy the minimum supported Rust version 2025-08-01 09:48:44 +01:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore Add Jeff Kirsher to .get_maintainer.ignore 2024-03-08 11:36:54 +00:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore rust: introduce .clippy.toml 2025-03-13 13:01:42 +01:00
.mailmap mailmap: add entry for Thorsten Blum 2024-11-07 14:14:59 -08:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Remove self from DSA entry 2024-11-03 12:52:38 -08:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS gpiolib-acpi: Update file references in the Documentation and MAINTAINERS 2026-02-11 13:40:29 +01:00
Makefile kbuild: Add objtool to top-level clean target 2026-03-04 07:20:35 -05:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.