Add an explicit size check in kmalloc_reserve() to reject requests larger than KMALLOC_MAX_SIZE before they reach the allocator. syzbot reported warnings triggered by attempts to allocate buffers with an object size exceeding KMALLOC_MAX_SIZE. While the existing code relies on kmalloc() failure and a comment states that truncation is "harmless", in practice this causes high-order allocation warnings and noisy kernel logs that interfere with testing. This patch introduces an early guard in kmalloc_reserve() that returns NULL if obj_size exceeds KMALLOC_MAX_SIZE. This ensures impossible requests fail fast and silently, avoiding allocator warnings while keeping the intended semantics unchanged. Fixes: 7fa4d8dc380f ("Add linux-next specific files for 20250821") Reported-by: syzbot+5a2250fd91b28106c37b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5a2250fd91b28106c37b --- v2: - Add WARN_ONCE() to make oversized allocations visible Signed-off-by: Kriish Sharma --- net/core/skbuff.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index ee0274417948..70588f98c07e 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -591,6 +591,13 @@ static void *kmalloc_reserve(unsigned int *size, gfp_t flags, int node, /* The following cast might truncate high-order bits of obj_size, this * is harmless because kmalloc(obj_size >= 2^32) will fail anyway. */ + if (unlikely(obj_size > KMALLOC_MAX_SIZE)) { + WARN_ONCE(1, + "%s: request size %zu exceeds KMALLOC_MAX_SIZE (%lu)\n", + __func__, obj_size, KMALLOC_MAX_SIZE); + return NULL; + } + *size = (unsigned int)obj_size; /* -- 2.34.1