Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1258204
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.12 015/123] net: add length argument to skb_copy_and_csum_datagram_iovec |
| Date | 2015-10-28 15:40 +0100 |
| Message-ID | <qoA3q-3Pi-73@gated-at.bofh.it> (permalink) |
| References | <qozqF-3k6-9@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: Sabrina Dubroca <sd@queasysnail.net>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
Without this length argument, we can read past the end of the iovec in
memcpy_toiovec because we have no way of knowing the total length of the
iovec's buffers.
This is needed for stable kernels where 89c22d8c3b27 ("net: Fix skb
csum races when peeking") has been backported but that don't have the
ioviter conversion, which is almost all the stable trees <= 3.18.
This also fixes a kernel crash for NFS servers when the client uses
-onfsvers=3,proto=udp to mount the export.
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
include/linux/skbuff.h | 3 ++-
net/core/datagram.c | 6 +++++-
net/ipv4/tcp_input.c | 2 +-
net/ipv4/udp.c | 2 +-
net/ipv6/raw.c | 2 +-
net/ipv6/udp.c | 3 ++-
net/rxrpc/ar-recvmsg.c | 3 ++-
7 files changed, 14 insertions(+), 7 deletions(-)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 79147dc9630d..47032528386a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2350,7 +2350,8 @@ extern int skb_copy_datagram_iovec(const struct sk_buff *from,
int size);
extern int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
int hlen,
- struct iovec *iov);
+ struct iovec *iov,
+ int len);
extern int skb_copy_datagram_from_iovec(struct sk_buff *skb,
int offset,
const struct iovec *from,
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 98e3d61e7476..f22f120771ef 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -796,6 +796,7 @@ EXPORT_SYMBOL(__skb_checksum_complete);
* @skb: skbuff
* @hlen: hardware length
* @iov: io vector
+ * @len: amount of data to copy from skb to iov
*
* Caller _must_ check that skb will fit to this iovec.
*
@@ -805,11 +806,14 @@ EXPORT_SYMBOL(__skb_checksum_complete);
* can be modified!
*/
int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
- int hlen, struct iovec *iov)
+ int hlen, struct iovec *iov, int len)
{
__wsum csum;
int chunk = skb->len - hlen;
+ if (chunk > len)
+ chunk = len;
+
if (!chunk)
return 0;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 49c87a39948f..4829750aa424 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4892,7 +4892,7 @@ static int tcp_copy_to_iovec(struct sock *sk, struct sk_buff *skb, int hlen)
err = skb_copy_datagram_iovec(skb, hlen, tp->ucopy.iov, chunk);
else
err = skb_copy_and_csum_datagram_iovec(skb, hlen,
- tp->ucopy.iov);
+ tp->ucopy.iov, chunk);
if (!err) {
tp->ucopy.len -= chunk;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 268ed25f2d65..4908eaa1cdec 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1245,7 +1245,7 @@ try_again:
else {
err = skb_copy_and_csum_datagram_iovec(skb,
sizeof(struct udphdr),
- msg->msg_iov);
+ msg->msg_iov, copied);
if (err == -EINVAL)
goto csum_copy_err;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 430067cb9210..0d51ebc176a7 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -489,7 +489,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
goto csum_copy_err;
err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
} else {
- err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov);
+ err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov, copied);
if (err == -EINVAL)
goto csum_copy_err;
}
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e09ca285e8f5..946ee8efe74b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -410,7 +410,8 @@ try_again:
err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
msg->msg_iov, copied);
else {
- err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
+ err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),
+ msg->msg_iov, copied);
if (err == -EINVAL)
goto csum_copy_err;
}
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index 5cc2da5d295d..c67f5d3f6e61 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -185,7 +185,8 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
msg->msg_iov, copy);
} else {
ret = skb_copy_and_csum_datagram_iovec(skb, offset,
- msg->msg_iov);
+ msg->msg_iov,
+ copy);
if (ret == -EINVAL)
goto csum_copy_error;
}
--
2.6.2
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.12 001/123] x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
[PATCH 3.12 027/123] ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
[PATCH 3.12 035/123] arc,hexagon: Delete asm/barrier.h Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
[PATCH 3.12 037/123] spi: Fix documentation of spi_alloc_master() Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
[PATCH 3.12 029/123] x86/apic: Serialize LVTT and TSC_DEADLINE writes Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
[PATCH 3.12 026/123] windfarm: decrement client count when unregistering Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:00 +0100
[PATCH 3.12 021/123] perf stat: Get correct cpu id for print_aggr Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
[PATCH 3.12 030/123] x86/platform: Fix Geode LX timekeeping in the generic x86 build Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
[PATCH 3.12 031/123] x86/mm: Set NX on gap between __ex_table and rodata Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
[PATCH 3.12 033/123] arch: Clean up asm/barrier.h implementations using asm-generic/barrier.h Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
[PATCH 3.12 032/123] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
Re: [PATCH 3.12 032/123] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Luis Henriques <luis.henriques@canonical.com> - 2015-10-28 16:30 +0100
Re: [PATCH 3.12 032/123] x86/xen: Support kexec/kdump in HVM guests by doing a soft reset Jiri Slaby <jslaby@suse.cz> - 2015-10-28 16:40 +0100
[PATCH 3.12 022/123] perf header: Fixup reading of HEADER_NRCPUS feature Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
[PATCH 3.12 034/123] arch: Move smp_mb__{before,after}_atomic_{inc,dec}.h into asm/atomic.h Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
[PATCH 3.12 025/123] ARM: 8429/1: disable GCC SRA optimization Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
[PATCH 3.12 028/123] dmaengine: dw: properly read DWC_PARAMS register Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:30 +0100
[PATCH 3.12 014/123] ARM: 7880/1: Clear the IT state independent of the Thumb-2 mode Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 036/123] sched/core: Fix TASK_DEAD race in finish_task_switch() Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 012/123] s390/3270: redraw screen on unsolicited device end Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 013/123] Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 023/123] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 017/123] kvm: fix zero length mmio searching Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 018/123] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 002/123] x86/paravirt: Replace the paravirt nop with a bona fide empty function Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 020/123] perf hists: Update the column width for the "srcline" sort key Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 019/123] iser-target: remove command with state ISTATE_REMOVE Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 024/123] ARM: fix Thumb2 signal handling when ARMv6 is enabled Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 016/123] ALSA: hda - Control SPDIF out pin on MacBookPro 11,2 Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 015/123] net: add length argument to skb_copy_and_csum_datagram_iovec Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:40 +0100
[PATCH 3.12 004/123] rcu: Reject memory-order-induced stall-warning false positives Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
[PATCH 3.12 005/123] sched: Fix cpu_active_mask/cpu_online_mask race Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
[PATCH 3.12 007/123] xhci: rework cycle bit checking for new dequeue pointers Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
[PATCH 3.12 006/123] xhci: Workaround for PME stuck issues in Intel xhci Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
[PATCH 3.12 009/123] USB: usbtmc: add device quirk for Rigol DS6104 Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
Re: [PATCH 3.12 009/123] USB: usbtmc: add device quirk for Rigol DS6104 Teunis van Beelen <teuniz@gmail.com> - 2015-10-28 16:40 +0100
[PATCH 3.12 008/123] usb: core: Fix USB 3.0 devices lost in NOTATTACHED state after a hub port reset Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
[PATCH 3.12 010/123] client MUST ignore EncryptionKeyLength if CAP_EXTENDED_SECURITY is set Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
[PATCH 3.12 011/123] iommu/amd: Handle integer overflow in dma_ops_area_alloc Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
[PATCH 3.12 003/123] jbd2: avoid infinite loop when destroying aborted journal Jiri Slaby <jslaby@suse.cz> - 2015-10-28 15:50 +0100
csiph-web