Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1269603
| From | Ben Hutchings <ben@decadent.org.uk> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.2 51/60] net: add length argument to skb_copy_and_csum_datagram_iovec |
| Date | 2015-11-15 03:20 +0100 |
| Message-ID | <quV58-3JS-35@gated-at.bofh.it> (permalink) |
| References | <quUVr-3GF-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.2.73-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
Without this length argument, we can read past the end of the iovec in
memcpy_toiovec because we have no way of knowing the total length of the
iovec's buffers.
This is needed for stable kernels where 89c22d8c3b27 ("net: Fix skb
csum races when peeking") has been backported but that don't have the
ioviter conversion, which is almost all the stable trees <= 3.18.
This also fixes a kernel crash for NFS servers when the client uses
-onfsvers=3,proto=udp to mount the export.
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
[bwh: Backported to 3.2: adjust context in include/linux/skbuff.h]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2131,7 +2131,8 @@ extern int skb_copy_datagram_iove
int size);
extern int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
int hlen,
- struct iovec *iov);
+ struct iovec *iov,
+ int len);
extern int skb_copy_datagram_from_iovec(struct sk_buff *skb,
int offset,
const struct iovec *from,
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -709,6 +709,7 @@ EXPORT_SYMBOL(__skb_checksum_complete);
* @skb: skbuff
* @hlen: hardware length
* @iov: io vector
+ * @len: amount of data to copy from skb to iov
*
* Caller _must_ check that skb will fit to this iovec.
*
@@ -718,11 +719,14 @@ EXPORT_SYMBOL(__skb_checksum_complete);
* can be modified!
*/
int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
- int hlen, struct iovec *iov)
+ int hlen, struct iovec *iov, int len)
{
__wsum csum;
int chunk = skb->len - hlen;
+ if (chunk > len)
+ chunk = len;
+
if (!chunk)
return 0;
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5198,7 +5198,7 @@ static int tcp_copy_to_iovec(struct sock
err = skb_copy_datagram_iovec(skb, hlen, tp->ucopy.iov, chunk);
else
err = skb_copy_and_csum_datagram_iovec(skb, hlen,
- tp->ucopy.iov);
+ tp->ucopy.iov, chunk);
if (!err) {
tp->ucopy.len -= chunk;
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1207,7 +1207,7 @@ try_again:
else {
err = skb_copy_and_csum_datagram_iovec(skb,
sizeof(struct udphdr),
- msg->msg_iov);
+ msg->msg_iov, copied);
if (err == -EINVAL)
goto csum_copy_err;
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -479,7 +479,7 @@ static int rawv6_recvmsg(struct kiocb *i
goto csum_copy_err;
err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
} else {
- err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov);
+ err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov, copied);
if (err == -EINVAL)
goto csum_copy_err;
}
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -383,7 +383,8 @@ try_again:
err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
msg->msg_iov, copied );
else {
- err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
+ err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),
+ msg->msg_iov, copied);
if (err == -EINVAL)
goto csum_copy_err;
}
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -185,7 +185,8 @@ int rxrpc_recvmsg(struct kiocb *iocb, st
msg->msg_iov, copy);
} else {
ret = skb_copy_and_csum_datagram_iovec(skb, offset,
- msg->msg_iov);
+ msg->msg_iov,
+ copy);
if (ret == -EINVAL)
goto csum_copy_error;
}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.2 00/60] 3.2.73-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 43/60] dm btree remove: fix a bug when rebalancing nodes after removal Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 27/60] 3w-9xxx: don't unmap bounce buffered commands Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 12/60] genirq: Fix race in register_irq_proc() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 31/60] iommu/vt-d: fix range computation when making room for large pages Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 28/60] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 32/60] xhci: don't finish a TD if we get a short transfer event mid TD Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 46/60] md/raid1: don't clear bitmap bit when bad-block-list write fails. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 24/60] iwlwifi: dvm: fix D3 firmware PN programming Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 04/60] regmap: debugfs: Don't bother actually printing when calculating max length Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:10 +0100
[PATCH 3.2 55/60] asix: Don't reset PHY on if_up for ASIX 88772 Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 08/60] UBI: Validate data_size Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 53/60] skbuff: Fix skb checksum partial check. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 38/60] IB/cm: Fix rb-tree duplicate free and use-after-free Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 20/60] usb: Add device quirk for Logitech PTZ cameras Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 33/60] xhci: handle no ping response error properly Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 19/60] USB: Add reset-resume quirk for two Plantronics usb headphones. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 44/60] dm btree: fix leak of bufio-backed block in btree_split_beneath error path Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 40/60] powerpc/rtas: Validate rtas.entry before calling enter_rtas() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 34/60] xhci: Switch Intel Lynx Point LP ports to EHCI on shutdown. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 07/60] x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 03/60] regmap: debugfs: Ensure we don't underflow when printing access masks Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 51/60] net: add length argument to skb_copy_and_csum_datagram_iovec Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 05/60] ath9k: declare required extra tx headroom Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 39/60] drm/nouveau/gem: return only valid domain when there's only one Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 06/60] m68k: Define asmlinkage_protect Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 26/60] sched/core: Fix TASK_DEAD race in finish_task_switch() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 45/60] md/raid1: ensure device failure recorded before write request returns. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 15/60] md/raid0: update queue parameter in a safer location. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 59/60] KEYS: Fix race between key destruction and finding a keyring by name Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 23/60] ppp: don't override sk->sk_state in pppoe_flush_dev() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 49/60] mvsas: Fix NULL pointer dereference in mvs_slot_task_free Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 58/60] KVM: x86: work around infinite loop in microcode when #AC is delivered Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:20 +0100
[PATCH 3.2 42/60] ppp: fix pppoe_dev deletion condition in pppoe_release() Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
[PATCH 3.2 10/60] MIPS: dma-default: Fix 32-bit fall back to GFP_DMA Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
[PATCH 3.2 50/60] sched: declare pid_alive as inline Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
[PATCH 3.2 17/60] clocksource: Fix abs() usage w/ 64bit values Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
[PATCH 3.2 36/60] crypto: api - Only abort operations on fatal signal Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
[PATCH 3.2 16/60] md/raid0: apply base queue limits *before* disk_stack_limits Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
[PATCH 3.2 47/60] md/raid10: ensure device failure recorded before write request returns. Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
[PATCH 3.2 57/60] Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
[PATCH 3.2 14/60] [SMB3] Do not fall back to SMBWriteX in set_file_size error cases Ben Hutchings <ben@decadent.org.uk> - 2015-11-15 03:30 +0100
Re: [PATCH 3.2 00/60] 3.2.73-rc1 review Guenter Roeck <linux@roeck-us.net> - 2015-11-15 14:50 +0100
Re: [PATCH 3.2 00/60] 3.2.73-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2015-11-16 12:20 +0100
csiph-web