lkml.org 
[lkml]   [2024]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] tls: fix WARNING in __sk_msg_free
Date
Syzbot constructed 32 scatterlists, and the data members in struct sk_msg_sg 
can only store a maximum of MAX_MSG_FRAGS scatterlists.
However, the value of MAX_MSG_FRAGS=CONFIG_MAX_SKB_FRAG is less than 32, which
leads to the warning reported here.

Prevent similar issues from occurring by checking whether sg.end is greater
than MAX_MSG_FRAGS.

Reported-and-tested-by: syzbot+f2977222e0e95cec15c8@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
net/tls/tls_sw.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index e37b4d2e2acd..68dbe821f61d 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -1016,6 +1016,8 @@ static int tls_sw_sendmsg_locked(struct sock *sk, struct msghdr *msg,

msg_pl = &rec->msg_plaintext;
msg_en = &rec->msg_encrypted;
+ if (msg_pl->sg.end >= MAX_MSG_FRAGS)
+ return -EINVAL;

orig_size = msg_pl->sg.size;
full_record = false;
--
2.43.0

\
 
 \ /
  Last update: 2024-01-09 10:40    [W:0.048 / U:0.024 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site