[PATCH] net: datagram: fix integer overflow in zerocopy_sg_from_iter

[PATCH] net: datagram: fix integer overflow in zerocopy_sg_from_iter

[Jiangshan Yi]

zerocopy_sg_from_iter() computes the copy length as:

  copy = min_t(int, skb_headlen(skb), iov_iter_count(from));

iov_iter_count() returns size_t.  When it exceeds INT_MAX (e.g. via
io_uring provided buffers), the int cast wraps negative, wins the min()
comparison, and the negative copy propagates into
skb_copy_datagram_from_iter(), which can trigger WARN_ON or corrupt
data.

Use min_t(size_t, ...) so the comparison is done in the correct type.
The result is always <= skb_headlen(skb), which fits in int.

Fixes: 3a654f975bf9 ("new helpers: skb_copy_datagram_from_iter() and zerocopy_sg_from_iter()")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
 net/core/datagram.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/datagram.c b/net/core/datagram.c
index c285c6465923..fd8e17d25a3d 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -783,7 +783,7 @@ EXPORT_SYMBOL(__zerocopy_sg_from_iter);
  */
 int zerocopy_sg_from_iter(struct sk_buff *skb, struct iov_iter *from)
 {
-	int copy = min_t(int, skb_headlen(skb), iov_iter_count(from));
+	int copy = min_t(size_t, skb_headlen(skb), iov_iter_count(from));
 
 	/* copy up to skb headlen */
 	if (skb_copy_datagram_from_iter(skb, 0, from, copy))
-- 
2.25.1

Re: [PATCH] net: datagram: fix integer overflow in zerocopy_sg_from_iter

[Joe Damato]

On Tue, Jul 28, 2026 at 02:42:35PM +0800, Jiangshan Yi wrote:
> zerocopy_sg_from_iter() computes the copy length as:
> 
>   copy = min_t(int, skb_headlen(skb), iov_iter_count(from));
> 
> iov_iter_count() returns size_t.  When it exceeds INT_MAX (e.g. via
> io_uring provided buffers), the int cast wraps negative, wins the min()

idk I looked at the code and it looks to be capped at INT_MAX, so i'm not sure
that the io_uring example could ever happen ?

I think the commit message misstates what is actually possible

> comparison, and the negative copy propagates into
> skb_copy_datagram_from_iter(), which can trigger WARN_ON or corrupt
> data.
> 
> Use min_t(size_t, ...) so the comparison is done in the correct type.
> The result is always <= skb_headlen(skb), which fits in int.
> Fixes: 3a654f975bf9 ("new helpers: skb_copy_datagram_from_iter() and zerocopy_sg_from_iter()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
> ---
>  net/core/datagram.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/core/datagram.c b/net/core/datagram.c
> index c285c6465923..fd8e17d25a3d 100644
> --- a/net/core/datagram.c
> +++ b/net/core/datagram.c
> @@ -783,7 +783,7 @@ EXPORT_SYMBOL(__zerocopy_sg_from_iter);
>   */
>  int zerocopy_sg_from_iter(struct sk_buff *skb, struct iov_iter *from)
>  {
> -	int copy = min_t(int, skb_headlen(skb), iov_iter_count(from));
> +	int copy = min_t(size_t, skb_headlen(skb), iov_iter_count(from));

I don't get this.

Wouldn't copy need to also be a size_t to be consistent with the general
"idea" of this patch ?

If you leave copy as an int aren't you just shifting the alleged overflow to
the assignment ?

Even if you changed copy to a size_t then.....

>  
>  	/* copy up to skb headlen */
>  	if (skb_copy_datagram_from_iter(skb, 0, from, copy))

this would still be a problem because len here is an int ?

I feel like if you really wanna fix this you would have to use min3 or
something instead of min_t ?

But, I'd probably just leave it and not propose a patch to change this at all.