Eric Dumazet
e776af608f
tcp: fix error recovery in tcp_zerocopy_receive() ...
If user provides wrong virtual address in TCP_ZEROCOPY_RECEIVE
operation we want to return -EINVAL error.
But depending on zc->recv_skip_hint content, we might return
-EIO error if the socket has SOCK_DONE set.
Make sure to return -EINVAL in this case.
BUG: KMSAN: uninit-value in tcp_zerocopy_receive net/ipv4/tcp.c:1833 [inline]
BUG: KMSAN: uninit-value in do_tcp_getsockopt+0x4494/0x6320 net/ipv4/tcp.c:3685
CPU: 1 PID: 625 Comm: syz-executor.0 Not tainted 5.7.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x220 lib/dump_stack.c:118
kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
__msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
tcp_zerocopy_receive net/ipv4/tcp.c:1833 [inline]
do_tcp_getsockopt+0x4494/0x6320 net/ipv4/tcp.c:3685
tcp_getsockopt+0xf8/0x1f0 net/ipv4/tcp.c:3728
sock_common_getsockopt+0x13f/0x180 net/core/sock.c:3131
__sys_getsockopt+0x533/0x7b0 net/socket.c:2177
__do_sys_getsockopt net/socket.c:2192 [inline]
__se_sys_getsockopt+0xe1/0x100 net/socket.c:2189
__x64_sys_getsockopt+0x62/0x80 net/socket.c:2189
do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45c829
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1deeb72c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00000000004e01e0 RCX: 000000000045c829
RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000009
RBP: 000000000078bf00 R08: 0000000020000200 R09: 0000000000000000
R10: 00000000200001c0 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000001d8 R14: 00000000004d3038 R15: 00007f1deeb736d4
Local variable ----zc@do_tcp_getsockopt created at:
do_tcp_getsockopt+0x1a74/0x6320 net/ipv4/tcp.c:3670
do_tcp_getsockopt+0x1a74/0x6320 net/ipv4/tcp.c:3670
Fixes: 05255b823a61 ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-14 15:12:08 -07:00
2020-03-27 09:29:56 +00:00
2020-02-24 13:02:53 -08:00
2020-02-17 14:30:54 -08:00
2020-05-04 11:59:38 -07:00
2020-01-09 18:41:40 -08:00
2020-04-21 10:08:05 +02:00
2020-03-25 22:16:08 +01:00
2020-03-28 18:13:18 +01:00
2020-04-03 13:12:26 -07:00
2020-04-30 17:45:41 -07:00
2020-03-11 22:55:25 -07:00
2020-03-30 12:42:41 +02:00
2020-05-09 20:59:21 -07:00
2020-02-29 15:53:35 -08:00
2020-03-23 21:57:44 -07:00
2020-03-29 12:40:41 +01:00
2020-05-06 17:31:54 -07:00
2020-01-27 11:09:31 +01:00
2020-03-29 22:32:37 -07:00
2020-05-06 15:00:20 -07:00
2020-03-03 13:28:48 -08:00
2020-05-14 15:12:08 -07:00
2020-05-12 18:12:40 -07:00
2020-03-16 17:14:02 -07:00
2020-04-08 14:30:46 -07:00
2020-02-26 20:38:13 -08:00
2020-04-24 11:31:20 +02:00
2020-03-29 22:30:57 -07:00
2020-05-12 12:08:22 -07:00
2020-01-09 18:36:22 -08:00
2020-05-12 13:19:34 +02:00
2020-05-12 18:12:40 -07:00
2020-03-25 18:58:11 -07:00
2020-04-18 13:09:46 -07:00
2020-03-12 22:34:48 -07:00
2020-04-20 10:53:54 -07:00
2020-03-15 00:25:25 -07:00
2020-01-03 12:25:50 -08:00
2020-04-09 10:08:31 -07:00
2020-04-15 12:33:29 -07:00
2020-01-26 10:40:21 +01:00
2020-04-14 16:26:47 -07:00
2020-05-06 20:13:10 -07:00
2020-04-22 19:27:40 -07:00
2020-03-12 22:34:48 -07:00
2020-05-02 11:24:01 -07:00
2020-02-26 20:58:33 -08:00
2020-05-13 12:33:19 -07:00
2020-04-27 11:22:38 -07:00
2020-02-28 12:12:53 -08:00
2020-04-27 10:18:01 -07:00
2020-04-14 12:28:48 +02:00
2020-04-28 14:08:59 -07:00
2020-04-15 13:07:18 +02:00
2020-03-30 10:59:20 -07:00
2020-03-10 09:12:49 -06:00
2020-03-25 12:24:33 -07:00
2020-01-24 13:44:07 +01:00
2020-03-30 12:18:49 -07:00
e776af608f