------------[ cut here ]------------ n > v || v > page_size(head) WARNING: lib/iov_iter.c:356 at page_copy_sane lib/iov_iter.c:356 [inline], CPU#2: syz.3.546/7624 WARNING: lib/iov_iter.c:356 at page_copy_sane lib/iov_iter.c:338 [inline], CPU#2: syz.3.546/7624 WARNING: lib/iov_iter.c:356 at copy_page_to_iter+0xbd/0x370 lib/iov_iter.c:365, CPU#2: syz.3.546/7624 Modules linked in: CPU: 2 UID: 0 PID: 7624 Comm: syz.3.546 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:page_copy_sane lib/iov_iter.c:356 [inline] RIP: 0010:page_copy_sane lib/iov_iter.c:338 [inline] RIP: 0010:copy_page_to_iter+0xbd/0x370 lib/iov_iter.c:365 Code: 83 e8 01 49 09 c6 4d 21 ee 4c 29 f3 48 c1 fb 06 48 c1 e3 0c 4c 01 fb 48 89 de e8 6e e3 11 fd 48 39 eb 73 27 e8 44 e9 11 fd 90 <0f> 0b 90 45 31 f6 e8 38 e9 11 fd 4c 89 f0 48 83 c4 10 5b 5d 41 5c RSP: 0018:ffffc90020daf730 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000022e RCX: ffffffff84f695d2 RDX: ffff88802816a500 RSI: ffffffff84f695dc RDI: ffff88802816a500 RBP: ffffffffffffff6c R08: 0000000000000006 R09: ffffffffffffff6c R10: 000000000000022e R11: 0000000000000000 R12: 00000000000002c2 R13: ffffea0000fa0400 R14: ffffea0000fa0400 R15: 000000000000022e FS: 00007f7ef30f36c0(0000) GS:ffff8880d657c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7ef30d2d58 CR3: 0000000038536000 CR4: 0000000000352ef0 Call Trace: __sk_msg_recvmsg+0x4fd/0x10c0 net/core/skmsg.c:443 udp_bpf_recvmsg net/ipv4/udp_bpf.c:83 [inline] udp_bpf_recvmsg+0x1a8/0x9d0 net/ipv4/udp_bpf.c:61 inet_recvmsg+0x455/0x4c0 net/ipv4/af_inet.c:896 sock_recvmsg_nosec net/socket.c:1137 [inline] sock_recvmsg+0x187/0x1f0 net/socket.c:1159 ____sys_recvmsg+0x218/0x640 net/socket.c:2918 ___sys_recvmsg+0x16a/0x1a0 net/socket.c:2960 do_recvmmsg+0x301/0x760 net/socket.c:3055 __sys_recvmmsg net/socket.c:3129 [inline] __do_sys_recvmmsg net/socket.c:3152 [inline] __se_sys_recvmmsg net/socket.c:3145 [inline] __x64_sys_recvmmsg+0x22a/0x280 net/socket.c:3145 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7ef219c819