skb_zerocopy() BUG()s if @from has no head_frag and the caller passed hlen == 0, meaning the caller didn't ask for the head to be copied and the head can't be referenced as a page either. The check runs before anything is touched, and skb_zerocopy() already documents -EFAULT for bad skb geometry. Warn once and return that. Assisted-by: LLM Signed-off-by: Josef Bacik --- net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index e29eda2eaf3f..8c6a45a20eb0 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3906,7 +3906,8 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) struct page *page; unsigned int offset; - BUG_ON(!from->head_frag && !hlen); + if (WARN_ON_ONCE(!from->head_frag && !hlen)) + return -EFAULT; /* dont bother with small payloads */ if (len <= skb_tailroom(to)) -- 2.55.0