lkml.org 
[lkml]   [2022]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.19 0489/1157] skmsg: Fix invalid last sg check in sk_msg_recvmsg()
    Date
    From: Liu Jian <liujian56@huawei.com>

    [ Upstream commit 9974d37ea75f01b47d16072b5dad305bd8d23fcc ]

    In sk_psock_skb_ingress_enqueue function, if the linear area + nr_frags +
    frag_list of the SKB has NR_MSG_FRAG_IDS blocks in total, skb_to_sgvec
    will return NR_MSG_FRAG_IDS, then msg->sg.end will be set to
    NR_MSG_FRAG_IDS, and in addition, (NR_MSG_FRAG_IDS - 1) is set to the last
    SG of msg. Recv the msg in sk_msg_recvmsg, when i is (NR_MSG_FRAG_IDS - 1),
    the sk_msg_iter_var_next(i) will change i to 0 (not NR_MSG_FRAG_IDS), the
    judgment condition "msg_rx->sg.start==msg_rx->sg.end" and
    "i != msg_rx->sg.end" can not work.

    As a result, the processed msg cannot be deleted from ingress_msg list.
    But the length of all the sge of the msg has changed to 0. Then the next
    recvmsg syscall will process the msg repeatedly, because the length of sge
    is 0, the -EFAULT error is always returned.

    Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface")
    Signed-off-by: Liu Jian <liujian56@huawei.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: John Fastabend <john.fastabend@gmail.com>
    Link: https://lore.kernel.org/bpf/20220628123616.186950-1-liujian56@huawei.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/core/skmsg.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/net/core/skmsg.c b/net/core/skmsg.c
    index b0fcd0200e84..a8dbea559c7f 100644
    --- a/net/core/skmsg.c
    +++ b/net/core/skmsg.c
    @@ -462,7 +462,7 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,

    if (copied == len)
    break;
    - } while (i != msg_rx->sg.end);
    + } while (!sg_is_last(sge));

    if (unlikely(peek)) {
    msg_rx = sk_psock_next_msg(psock, msg_rx);
    @@ -472,7 +472,7 @@ int sk_msg_recvmsg(struct sock *sk, struct sk_psock *psock, struct msghdr *msg,
    }

    msg_rx->sg.start = i;
    - if (!sge->length && msg_rx->sg.start == msg_rx->sg.end) {
    + if (!sge->length && sg_is_last(sge)) {
    msg_rx = sk_psock_dequeue_msg(psock);
    kfree_sk_msg(msg_rx);
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-16 01:57    [W:5.135 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site