Syzbot constructed 32 scatterlists, and the data members in struct sk_msg_sg can only store a maximum of MAX_MSG_FRAGS scatterlists. However, the value of MAX_MSG_FRAGS=CONFIG_MAX_SKB_FRAG is less than 32, which leads to the warning reported here. Prevent similar issues from occurring by checking whether sg.end is greater than MAX_MSG_FRAGS. Reported-and-tested-by: syzbot+f2977222e0e95cec15c8@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Edward Adam Davis <eadavis@xxxxxx> --- net/tls/tls_sw.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c index e37b4d2e2acd..68dbe821f61d 100644 --- a/net/tls/tls_sw.c +++ b/net/tls/tls_sw.c @@ -1016,6 +1016,8 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg, msg_pl = &rec->msg_plaintext; msg_en = &rec->msg_encrypted; + if (msg_pl->sg.end >= MAX_MSG_FRAGS) + return -EINVAL; orig_size = msg_pl->sg.size; full_record = false; -- 2.43.0
