lkml.org 
[lkml]   [2015]   [Nov]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 51/60] net: add length argument to skb_copy_and_csum_datagram_iovec
    3.2.73-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Sabrina Dubroca <sd@queasysnail.net>

    Without this length argument, we can read past the end of the iovec in
    memcpy_toiovec because we have no way of knowing the total length of the
    iovec's buffers.

    This is needed for stable kernels where 89c22d8c3b27 ("net: Fix skb
    csum races when peeking") has been backported but that don't have the
    ioviter conversion, which is almost all the stable trees <= 3.18.

    This also fixes a kernel crash for NFS servers when the client uses
    -onfsvers=3,proto=udp to mount the export.

    Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
    Reviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    [bwh: Backported to 3.2: adjust context in include/linux/skbuff.h]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    --- a/include/linux/skbuff.h
    +++ b/include/linux/skbuff.h
    @@ -2131,7 +2131,8 @@ extern int skb_copy_datagram_iove
    int size);
    extern int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
    int hlen,
    - struct iovec *iov);
    + struct iovec *iov,
    + int len);
    extern int skb_copy_datagram_from_iovec(struct sk_buff *skb,
    int offset,
    const struct iovec *from,
    --- a/net/core/datagram.c
    +++ b/net/core/datagram.c
    @@ -709,6 +709,7 @@ EXPORT_SYMBOL(__skb_checksum_complete);
    * @skb: skbuff
    * @hlen: hardware length
    * @iov: io vector
    + * @len: amount of data to copy from skb to iov
    *
    * Caller _must_ check that skb will fit to this iovec.
    *
    @@ -718,11 +719,14 @@ EXPORT_SYMBOL(__skb_checksum_complete);
    * can be modified!
    */
    int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
    - int hlen, struct iovec *iov)
    + int hlen, struct iovec *iov, int len)
    {
    __wsum csum;
    int chunk = skb->len - hlen;

    + if (chunk > len)
    + chunk = len;
    +
    if (!chunk)
    return 0;

    --- a/net/ipv4/tcp_input.c
    +++ b/net/ipv4/tcp_input.c
    @@ -5198,7 +5198,7 @@ static int tcp_copy_to_iovec(struct sock
    err = skb_copy_datagram_iovec(skb, hlen, tp->ucopy.iov, chunk);
    else
    err = skb_copy_and_csum_datagram_iovec(skb, hlen,
    - tp->ucopy.iov);
    + tp->ucopy.iov, chunk);

    if (!err) {
    tp->ucopy.len -= chunk;
    --- a/net/ipv4/udp.c
    +++ b/net/ipv4/udp.c
    @@ -1207,7 +1207,7 @@ try_again:
    else {
    err = skb_copy_and_csum_datagram_iovec(skb,
    sizeof(struct udphdr),
    - msg->msg_iov);
    + msg->msg_iov, copied);

    if (err == -EINVAL)
    goto csum_copy_err;
    --- a/net/ipv6/raw.c
    +++ b/net/ipv6/raw.c
    @@ -479,7 +479,7 @@ static int rawv6_recvmsg(struct kiocb *i
    goto csum_copy_err;
    err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
    } else {
    - err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov);
    + err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov, copied);
    if (err == -EINVAL)
    goto csum_copy_err;
    }
    --- a/net/ipv6/udp.c
    +++ b/net/ipv6/udp.c
    @@ -383,7 +383,8 @@ try_again:
    err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
    msg->msg_iov, copied );
    else {
    - err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
    + err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),
    + msg->msg_iov, copied);
    if (err == -EINVAL)
    goto csum_copy_err;
    }
    --- a/net/rxrpc/ar-recvmsg.c
    +++ b/net/rxrpc/ar-recvmsg.c
    @@ -185,7 +185,8 @@ int rxrpc_recvmsg(struct kiocb *iocb, st
    msg->msg_iov, copy);
    } else {
    ret = skb_copy_and_csum_datagram_iovec(skb, offset,
    - msg->msg_iov);
    + msg->msg_iov,
    + copy);
    if (ret == -EINVAL)
    goto csum_copy_error;
    }


    \
     
     \ /
      Last update: 2015-11-15 03:41    [W:4.551 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site