mirror
/
linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
linux/net
History
Liu Jian 9974d37ea7 skmsg: Fix invalid last sg check in sk_msg_recvmsg() 
In sk_psock_skb_ingress_enqueue function, if the linear area + nr_frags +
frag_list of the SKB has NR_MSG_FRAG_IDS blocks in total, skb_to_sgvec
will return NR_MSG_FRAG_IDS, then msg->sg.end will be set to
NR_MSG_FRAG_IDS, and in addition, (NR_MSG_FRAG_IDS - 1) is set to the last
SG of msg. Recv the msg in sk_msg_recvmsg, when i is (NR_MSG_FRAG_IDS - 1),
the sk_msg_iter_var_next(i) will change i to 0 (not NR_MSG_FRAG_IDS), the
judgment condition "msg_rx->sg.start==msg_rx->sg.end" and
"i != msg_rx->sg.end" can not work.

As a result, the processed msg cannot be deleted from ingress_msg list.
But the length of all the sge of the msg has changed to 0. Then the next
recvmsg syscall will process the msg repeatedly, because the length of sge
is 0, the -EFAULT error is always returned.

Fixes: 604326b41a ("bpf, sockmap: convert to generic sk_msg interface")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20220628123616.186950-1-liujian56@huawei.com
 		2022-07-11 18:22:07 +02:00
..
6lowpan net: 6lowpan: constify lowpan_nhc structures 2022-06-09 21:53:28 +02:00
9p xen: switch gnttab_end_foreign_access() to take a struct page pointer 2022-05-27 11:05:29 +02:00
802
…
8021q vlan: adopt u64_stats_t 2022-06-09 21:53:09 -07:00
appletalk net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
atm net: SO_RCVMARK socket option for SO_MARK with recvmsg() 2022-04-28 13:08:15 -07:00
ax25 ax25: use GFP_KERNEL in ax25_dev_device_up() 2022-06-17 20:34:13 -07:00
batman-adv net: wrap the wireless pointers in struct net_device in an ifdef 2022-05-22 21:51:54 +01:00
bluetooth Bluetooth: core: Fix deadlock on hci_power_on_sync. 2022-07-05 13:20:03 -07:00
bpf bpf, test_run: Remove unnecessary prog type checks 2022-06-03 14:53:33 -07:00
bpfilter uaccess: remove CONFIG_SET_FS 2022-02-25 09:36:06 +01:00
bridge Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-06-30 16:31:00 -07:00
caif net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
can Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-07-07 12:07:37 -07:00
ceph libceph: use swap() macro instead of taking tmp variable 2022-05-25 20:45:13 +02:00
core skmsg: Fix invalid last sg check in sk_msg_recvmsg() 2022-07-11 18:22:07 +02:00
dcb net: dcb: disable softirqs in dcbnl_flush_dev() 2022-03-03 08:01:55 -08:00
dccp Revert "net: Add a second bind table hashed by port and address" 2022-06-16 11:07:59 -07:00
decnet net, neigh: introduce interval_probe_time_ms for periodic probe 2022-06-30 13:14:35 +02:00
dns_resolver
…
dsa net: dsa: tag_ksz: add tag handling for Microchip LAN937x 2022-07-02 16:34:05 +01:00
ethernet net: ethernet: set default assignment identifier to NET_NAME_ENUM 2022-04-07 21:04:03 -07:00
ethtool Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-06-23 12:33:24 -07:00
hsr net: add per-cpu storage and net->core_stats 2022-03-11 23:17:24 -08:00
ieee802154 net: SO_RCVMARK socket option for SO_MARK with recvmsg() 2022-04-28 13:08:15 -07:00
ife
…
ipv4 net: Find dst with sk's xfrm policy not ctl_sk 2022-07-11 13:39:56 +01:00
ipv6 net: Find dst with sk's xfrm policy not ctl_sk 2022-07-11 13:39:56 +01:00
iucv net: keep sk->sk_forward_alloc as small as possible 2022-06-10 16:21:27 -07:00
kcm net: Don't include filter.h from net/sock.h 2021-12-29 08:48:14 -08:00
key Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec 2022-06-01 17:44:04 -07:00
l2tp l2tp: l2tp_debugfs: fix Clang -Wformat warnings 2022-07-08 12:14:36 +01:00
l3mdev l3mdev: l3mdev_master_upper_ifindex_by_index_rcu should be using netdev_master_upper_dev_get_rcu 2022-04-15 14:27:24 -07:00
lapb
…
llc net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
mac80211 wireless-next patches for v5.20 2022-06-10 08:57:35 -07:00
mac802154 net: mac802154: Fix symbol durations 2022-04-30 20:29:47 +02:00
mctp Networking changes for 5.19. 2022-05-25 12:22:58 -07:00
mpls net: mpls: fix memdup.cocci warning 2022-04-07 21:06:41 -07:00
mptcp mptcp: move MPTCPOPT_HMAC_LEN to net/mptcp.h 2022-07-09 12:19:23 +01:00
ncsi net/ncsi: use proper "mellanox" DT vendor prefix 2022-06-23 20:51:06 -07:00
netfilter netfilter: nft_set_pipapo: release elements in clone from abort path 2022-07-02 21:04:19 +02:00
netlabel netlabel: fix out-of-bounds memory accesses 2022-03-21 10:59:11 +00:00
netlink Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-05-12 16:15:30 -07:00
netrom net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
nfc net: nfc: Directly use ida_alloc()/free() 2022-05-28 15:28:47 +01:00
nsh
…
openvswitch Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-06-23 12:33:24 -07:00
packet net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
phonet net: remove noblock parameter from recvmsg() entities 2022-04-12 15:00:25 +02:00
psample
…
qrtr net: remove noblock parameter from skb_recv_datagram() 2022-04-06 13:45:26 +01:00
rds Linux 5.18 2022-05-24 12:40:28 -03:00
rfkill rfkill: make new event layout opt-in 2022-03-18 13:09:17 +02:00
rose net: rose: fix UAF bug caused by rose_t0timer_expiry 2022-07-06 19:49:11 -07:00
rxrpc net: rxrpc: fix clang -Wformat warning 2022-07-08 20:15:11 -07:00
sched Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-07-07 12:07:37 -07:00
sctp net: keep sk->sk_forward_alloc as small as possible 2022-06-10 16:21:27 -07:00
smc net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
strparser strparser: pad sk_skb_cb to avoid straddling cachelines 2022-07-08 18:38:44 -07:00
sunrpc Notable regression fixes: 2022-07-02 11:20:56 -07:00
switchdev net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
tipc Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-06-30 16:31:00 -07:00
tls tls: rx: make tls_wait_data() return an recvmsg retcode 2022-07-08 18:38:45 -07:00
unix Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2022-07-09 12:24:16 -07:00
vmw_vsock hyperv-next for 5.19 2022-05-28 11:39:01 -07:00
wireless wireless-next patches for v5.19 2022-05-19 13:01:08 -07:00
x25 x25: remove redundant pointer dev 2022-05-10 11:59:22 +02:00
xdp Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-07-07 12:07:37 -07:00
xfrm net: rename reference+tracking helpers 2022-06-09 21:52:55 -07:00
Kconfig page_pool: Add allocation stats 2022-03-03 09:55:28 +00:00
Kconfig.debug net: CONFIG_DEBUG_NET depends on CONFIG_NET 2022-06-02 10:15:05 -07:00
Makefile
…
compat.c
…
devres.c
…
socket.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2022-06-30 16:31:00 -07:00
sysctl_net.c
…