A NULL page from sg_page() in sk_msg_recvmsg() can reach __kmap_local_page_prot() and crash the kernel. Add a check for the page before calling copy_page_to_iter() and fail early with -EFAULT to prevent the crash. Reported-by: syzbot+b18872ea9631b5dcef3b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b18872ea9631b5dcef3b Fixes: 2bc793e3272a ("skmsg: Extract __tcp_bpf_recvmsg() and tcp_bpf_wait_data()") Signed-off-by: Pranav Tyagi --- net/core/skmsg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 4d75ef9d24bf..f5367356a483 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -432,6 +432,10 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg, sge = sk_msg_elem(msg_rx, i); copy = sge->length; page = sg_page(sge); + if (!page) { + copied = copied ? copied : -EFAULT; + goto out; + } if (copied + copy > len) copy = len - copied; copy = copy_page_to_iter(page, sge->offset, copy, iter); -- 2.49.0