mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 22:54:01 +00:00
Code Issues Releases Wiki Activity

tcp: Sanitize CMSG flags and reserved args in tcp_zerocopy_receive.

Browse source 
Explicitly define reserved field and require it and any subsequent
fields to be zero-valued for now. Additionally, limit the valid CMSG
flags that tcp_zerocopy_receive accepts.

Fixes: 7eeba1706e ("tcp: Add receive timestamp support for receive zerocopy.")
Signed-off-by: Arjun Roy <arjunroy@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Suggested-by: David Ahern <dsahern@gmail.com>
Suggested-by: Leon Romanovsky <leon@kernel.org>
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Arjun Roy 2021-02-11 13:21:07 -08:00 committed by David S. Miller
parent 9fbb4a7ac4
commit 3c5a2fd042
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
include/uapi/linux/tcp.h
View file

@ -357,6 +357,6 @@ struct tcp_zerocopy_receive {
__u64 msg_control; /* ancillary data */
__u64 msg_controllen;
__u32 msg_flags;
/* __u32 hole; Next we must add >1 u32 otherwise length checks fail. */
__u32 reserved; /* set to 0 for now */
};
#endif /* _UAPI_LINUX_TCP_H */

11
net/ipv4/tcp.c
View file

@ -2030,6 +2030,7 @@ static int tcp_zerocopy_vm_insert_batch(struct vm_area_struct *vma,
err);
}
#define TCP_VALID_ZC_MSG_FLAGS (TCP_CMSG_TS)
static void tcp_recv_timestamp(struct msghdr *msg, const struct sock *sk,
struct scm_timestamping_internal *tss);
static void tcp_zc_finalize_rx_tstamp(struct sock *sk,
@ -4152,13 +4153,21 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
return -EFAULT;
if (len < offsetofend(struct tcp_zerocopy_receive, length))
return -EINVAL;
if (len > sizeof(zc)) {
if (unlikely(len > sizeof(zc))) {
err = check_zeroed_user(optval + sizeof(zc),
len - sizeof(zc));
if (err < 1)
return err == 0 ? -EINVAL : err;
len = sizeof(zc);
if (put_user(len, optlen))
return -EFAULT;
}
if (copy_from_user(&zc, optval, len))
return -EFAULT;
if (zc.reserved)
return -EINVAL;
if (zc.msg_flags & ~(TCP_VALID_ZC_MSG_FLAGS))
return -EINVAL;
lock_sock(sk);
err = tcp_zerocopy_receive(sk, &zc, &tss);
release_sock(sk);