| Message ID | 1519335627-143092-1-git-send-email-sowmini.varadhan@oracle.com |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net-next] rds: rds_msg_zcopy should return error of null rm->data.op_mmp_znotifier | expand |
On Thu, Feb 22, 2018 at 4:40 PM, Sowmini Varadhan <sowmini.varadhan@oracle.com> wrote: > if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been > specified, the rm->data.op_mmp_znotifier allocation will be skipped. > In this case, it is invalid ot pass down a cmsghdr with > RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this > case. > > Reported-by: syzbot+f893ae7bb2f6456dfbc3@syzkaller.appspotmail.com > Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.") > Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Acked-by: Willem de Bruijn <willemb@google.com>
On 2/22/2018 1:40 PM, Sowmini Varadhan wrote: > if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been > specified, the rm->data.op_mmp_znotifier allocation will be skipped. > In this case, it is invalid ot pass down a cmsghdr with > RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this > case. > > Reported-by: syzbot+f893ae7bb2f6456dfbc3@syzkaller.appspotmail.com > Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.") > Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> > --- Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
From: Sowmini Varadhan <sowmini.varadhan@oracle.com> Date: Thu, 22 Feb 2018 13:40:27 -0800 > if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been > specified, the rm->data.op_mmp_znotifier allocation will be skipped. > In this case, it is invalid ot pass down a cmsghdr with > RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this > case. > > Reported-by: syzbot+f893ae7bb2f6456dfbc3@syzkaller.appspotmail.com > Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.") > Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Applied, thank you.
diff --git a/net/rds/send.c b/net/rds/send.c index 028ab59..c848cbb 100644 --- a/net/rds/send.c +++ b/net/rds/send.c @@ -939,7 +939,8 @@ static int rds_cmsg_zcopy(struct rds_sock *rs, struct rds_message *rm, { u32 *cookie; - if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie))) + if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie)) || + !rm->data.op_mmp_znotifier) return -EINVAL; cookie = CMSG_DATA(cmsg); rm->data.op_mmp_znotifier->z_cookie = *cookie;
if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been specified, the rm->data.op_mmp_znotifier allocation will be skipped. In this case, it is invalid ot pass down a cmsghdr with RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this case. Reported-by: syzbot+f893ae7bb2f6456dfbc3@syzkaller.appspotmail.com Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.") Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> --- net/rds/send.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-)