iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/net/ipv4
History
Eric Dumazet e776af608f tcp: fix error recovery in tcp_zerocopy_receive() 
If user provides wrong virtual address in TCP_ZEROCOPY_RECEIVE
operation we want to return -EINVAL error.

But depending on zc->recv_skip_hint content, we might return
-EIO error if the socket has SOCK_DONE set.

Make sure to return -EINVAL in this case.

BUG: KMSAN: uninit-value in tcp_zerocopy_receive net/ipv4/tcp.c:1833 [inline]
BUG: KMSAN: uninit-value in do_tcp_getsockopt+0x4494/0x6320 net/ipv4/tcp.c:3685
CPU: 1 PID: 625 Comm: syz-executor.0 Not tainted 5.7.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x220 lib/dump_stack.c:118
 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121
 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215
 tcp_zerocopy_receive net/ipv4/tcp.c:1833 [inline]
 do_tcp_getsockopt+0x4494/0x6320 net/ipv4/tcp.c:3685
 tcp_getsockopt+0xf8/0x1f0 net/ipv4/tcp.c:3728
 sock_common_getsockopt+0x13f/0x180 net/core/sock.c:3131
 __sys_getsockopt+0x533/0x7b0 net/socket.c:2177
 __do_sys_getsockopt net/socket.c:2192 [inline]
 __se_sys_getsockopt+0xe1/0x100 net/socket.c:2189
 __x64_sys_getsockopt+0x62/0x80 net/socket.c:2189
 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:297
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45c829
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f1deeb72c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037
RAX: ffffffffffffffda RBX: 00000000004e01e0 RCX: 000000000045c829
RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000009
RBP: 000000000078bf00 R08: 0000000020000200 R09: 0000000000000000
R10: 00000000200001c0 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000001d8 R14: 00000000004d3038 R15: 00007f1deeb736d4

Local variable ----zc@do_tcp_getsockopt created at:
 do_tcp_getsockopt+0x1a74/0x6320 net/ipv4/tcp.c:3670
 do_tcp_getsockopt+0x1a74/0x6320 net/ipv4/tcp.c:3670

Fixes: 05255b823a61 ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Acked-by: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-05-14 15:12:08 -07:00
..
bpfilter
SPDX update for 5.2-rc2, round 1
2019-05-21 12:33:38 -07:00
netfilter
netfilter: Replace zero-length array with flexible-array member
2020-03-15 15:20:16 +01:00
af_inet.c
mptcp: add and use MIB counter infrastructure
2020-03-29 22:14:49 -07:00
ah4.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
arp.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
bpf_tcp_ca.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2020-03-30 19:52:37 -07:00
cipso_ipv4.c
netlabel: cope with NULL catmap
2020-05-12 18:12:40 -07:00
datagram.c
inet: stop leaking jiffies on the wire
2019-11-01 14:57:52 -07:00
devinet.c
net: ipv4: devinet: Fix crash when add/del multicast IP with autojoin
2020-04-09 10:27:23 -07:00
esp4_offload.c
esp4: add gso_segment for esp4 beet mode
2020-03-26 14:51:07 +01:00
esp4.c
ESP: Export esp_output_fill_trailer function
2020-02-19 13:52:32 +01:00
fib_frontend.c
ipv4: fix a RCU-list lock in inet_dump_fib()
2020-03-23 20:59:40 -07:00
fib_lookup.h
net: add net available in build_state
2020-03-29 22:30:57 -07:00
fib_notifier.c
net: fib_notifier: propagate extack down to the notifier block callback
2019-10-04 11:10:56 -07:00
fib_rules.c
net: fib_notifier: propagate extack down to the notifier block callback
2019-10-04 11:10:56 -07:00
fib_semantics.c
ipv4: Update fib_select_default to handle nexthop objects
2020-04-22 19:57:39 -07:00
fib_trie.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-03-30 20:48:43 -07:00
fou.c
fou: Fix IPv6 netlink policy
2020-01-23 14:32:52 +01:00
gre_demux.c
gre: fix uninit-value in __iptunnel_pull_header
2020-03-08 21:25:37 -07:00
gre_offload.c
net: remove the check argument from __skb_gro_checksum_convert
2020-01-03 12:24:34 -08:00
icmp.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
igmp.c
igmp: remove unused macro IGMP_Vx_UNSOLICITED_REPORT_INTERVAL
2020-02-23 21:15:36 -08:00
inet_connection_sock.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-03-12 22:34:48 -07:00
inet_diag.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-03-12 22:34:48 -07:00
inet_fragment.c
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
inet_hashtables.c
tcp/dccp: fix possible race __inet_lookup_established()
2019-12-13 21:40:49 -08:00
inet_timewait_sock.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
inetpeer.c
inetpeer: fix data-race in inet_putpeer / inet_putpeer
2019-11-07 16:15:56 -08:00
ip_forward.c
ipv4: Revert removal of rt_uses_gateway
2019-09-20 18:23:33 -07:00
ip_fragment.c
inet: frags: re-introduce skb coalescing for local delivery
2019-08-08 15:55:10 -07:00
ip_gre.c
net: ip_gre: Accept IFLA_INFO_DATA-less configuration
2020-03-16 17:19:56 -07:00
ip_input.c
bpf: Add socket assign support
2020-03-30 13:45:04 -07:00
ip_options.c
netfilter: nf_tables: add support for matching IPv4 options
2019-06-21 18:35:51 +02:00
ip_output.c
net: Fix typo of SKB_SGO_CB_OFFSET
2020-03-29 21:53:18 -07:00
ip_sockglue.c
ip_sockglue: Fix missing-check bug in ip_ra_control()
2019-05-25 11:00:50 -07:00
ip_tunnel_core.c
net: add net available in build_state
2020-03-29 22:30:57 -07:00
ip_tunnel.c
net, ip_tunnel: fix interface lookup with no key
2020-03-29 22:16:27 -07:00
ip_vti.c
vti[6]: fix packet tx through bpf_redirect() in XinY cases
2020-02-06 13:27:30 +01:00
ipcomp.c
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next
2019-07-05 15:01:15 -07:00
ipconfig.c
Documentation: nfsroot.rst: Fix references to nfsroot.rst
2020-03-02 13:11:46 -07:00
ipip.c
ipip: validate header length in ipip_tunnel_xmit
2019-07-25 17:23:40 -07:00
ipmr_base.c
net: fib_notifier: propagate extack down to the notifier block callback
2019-10-04 11:10:56 -07:00
ipmr.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
Kconfig
This has been a busy cycle for documentation work. Highlights include:
2020-03-30 12:45:23 -07:00
Makefile
bpf: Add sockmap hooks for UDP sockets
2020-03-09 22:34:58 +01:00
metrics.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
netfilter.c
netfilter: ipv4: remove useless export_symbol
2019-01-28 11:32:58 +01:00
netlink.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
nexthop.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
ping.c
ip: support SO_MARK cmsg
2019-09-13 21:44:19 +02:00
proc.c
mptcp: add and use MIB counter infrastructure
2020-03-29 22:14:49 -07:00
protocol.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
raw_diag.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-03-12 22:34:48 -07:00
raw.c
raw: Add missing annotations to raw_seq_start() and raw_seq_stop()
2020-03-11 23:19:40 -07:00
route.c
net: ipv4: really enforce backoff for redirects
2020-05-08 22:52:57 -07:00
syncookies.c
mptcp: handle tcp fallback when using syn cookies
2020-01-29 17:45:20 +01:00
sysctl_net_ipv4.c
tcp: bind(0) remove the SO_REUSEADDR restriction when ephemeral ports are exhausted.
2020-03-12 12:08:09 -07:00
tcp_bbr.c
tcp_bbr: improve arithmetic division in bbr_update_bw()
2020-01-21 10:45:49 +01:00
tcp_bic.c
tcp: fix stretch ACK bugs in BIC
2020-03-16 18:26:54 -07:00
tcp_bpf.c
bpf, sockmap: bpf_tcp_ingress needs to subtract bytes from sg.size
2020-05-06 00:22:22 +02:00
tcp_cdg.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_cong.c
bpf: tcp: Support tcp_congestion_ops in bpf
2020-01-09 08:46:18 -08:00
tcp_cubic.c
tcp_cubic: refactor code to perform a divide only when needed
2019-12-30 14:44:27 -08:00
tcp_dctcp.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp_dctcp.h
tcp: refactor DCTCP ECN ACK handling
2018-10-10 22:26:00 -07:00
tcp_diag.c
inet_diag: Move the INET_DIAG_REQ_BYTECODE nlattr to cb->data
2020-02-27 18:50:19 -08:00
tcp_fastopen.c
tcp: add TCP_INFO status for failed client TFO
2019-10-25 19:25:37 -07:00
tcp_highspeed.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_htcp.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_hybla.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_illinois.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_input.c
tcp: fix SO_RCVLOWAT hangs with fat skbs
2020-05-12 12:49:47 -07:00
tcp_ipv4.c
inet: Use fallthrough;
2020-03-12 15:55:00 -07:00
tcp_lp.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_metrics.c
net-tcp: Disable TCP ssthresh metrics cache by default
2019-12-09 20:17:48 -08:00
tcp_minisocks.c
mptcp: Add handling of incoming MP_JOIN requests
2020-03-29 22:14:48 -07:00
tcp_nv.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_offload.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
tcp_output.c
tcp: also NULL skb->dev when copy was needed
2020-03-20 19:36:38 -07:00
tcp_rate.c
treewide: Add SPDX license identifier for missed files
2019-05-21 10:50:45 +02:00
tcp_recovery.c
tcp: introduce tcp_skb_timestamp_us() helper
2018-09-21 19:37:59 -07:00
tcp_scalable.c
tcp: fix stretch ACK bugs in Scalable
2020-03-16 18:26:54 -07:00
tcp_timer.c
tcp: export count for rehash attempts
2020-01-26 15:28:47 +01:00
tcp_ulp.c
bpf: sockmap: Only check ULP for TCP sockets
2020-03-09 22:34:58 +01:00
tcp_vegas.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_vegas.h
…
tcp_veno.c
tcp: fix stretch ACK bugs in Veno
2020-03-16 18:26:55 -07:00
tcp_westwood.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
tcp_yeah.c
tcp: fix stretch ACK bugs in Yeah
2020-03-16 18:26:55 -07:00
tcp.c
tcp: fix error recovery in tcp_zerocopy_receive()
2020-05-14 15:12:08 -07:00
tunnel4.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
udp_bpf.c
bpf: Add sockmap hooks for UDP sockets
2020-03-09 22:34:58 +01:00
udp_diag.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
2020-03-12 22:34:48 -07:00
udp_impl.h
udp: add missing rehash callback to udplite
2019-01-17 15:01:08 -08:00
udp_offload.c
udp: initialize is_flist with 0 in udp_gro_receive
2020-03-30 10:35:03 -07:00
udp_tunnel.c
treewide: Add SPDX license identifier for more missed files
2019-05-21 10:50:45 +02:00
udp.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
2020-03-30 19:52:37 -07:00
udplite.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152
2019-05-30 11:26:32 -07:00
xfrm4_input.c
xfrm: reset transport header back to network header after all input transforms ahave been applied
2018-09-04 10:26:30 +02:00
xfrm4_output.c
xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish
2020-04-22 12:32:11 -07:00
xfrm4_policy.c
net: add bool confirm_neigh parameter for dst_ops.update_pmtu
2019-12-24 22:28:54 -08:00
xfrm4_protocol.c
xfrm: add route lookup to xfrm4_rcv_encap
2019-12-09 09:59:07 +01:00
xfrm4_state.c
xfrm: remove eth_proto value from xfrm_state_afinfo
2019-06-06 08:34:50 +02:00
xfrm4_tunnel.c
xfrm: remove type and offload_type map from xfrm_state_afinfo
2019-06-06 08:34:50 +02:00