Tung Nguyen 11a4d6f67c tipc: fix kernel warning when sending SYN message ... When sending a SYN message, this kernel stack trace is observed: ... [ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550 ... [ 13.398494] Call Trace: [ 13.398630] <TASK> [ 13.398630] ? __alloc_skb+0xed/0x1a0 [ 13.398630] tipc_msg_build+0x12c/0x670 [tipc] [ 13.398630] ? shmem_add_to_page_cache.isra.71+0x151/0x290 [ 13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc] [ 13.398630] ? tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __local_bh_enable_ip+0x37/0x80 [ 13.398630] tipc_connect+0x1d9/0x230 [tipc] [ 13.398630] ? __sys_connect+0x9f/0xd0 [ 13.398630] __sys_connect+0x9f/0xd0 [ 13.398630] ? preempt_count_add+0x4d/0xa0 [ 13.398630] ? fpregs_assert_state_consistent+0x22/0x50 [ 13.398630] __x64_sys_connect+0x16/0x20 [ 13.398630] do_syscall_64+0x42/0x90 [ 13.398630] entry_SYSCALL_64_after_hwframe+0x63/0xcd It is because commit a41dad905e ("iov_iter: saner checks for attempt to copy to/from iterator") has introduced sanity check for copying from/to iov iterator. Lacking of copy direction from the iterator viewpoint would lead to kernel stack trace like above. This commit fixes this issue by initializing the iov iterator with the correct copy direction when sending SYN or ACK without data. Fixes: f25dcc7687 ("tipc: tipc ->sendmsg() conversion") Reported-by: syzbot+d43608d061e8847ec9f3@syzkaller.appspotmail.com Acked-by: Jon Maloy <jmaloy@redhat.com> Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au> Link: https://lore.kernel.org/r/20230214012606.5804-1-tung.q.nguyen@dektech.com.au Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2023-02-14 20:46:24 -08:00
..
addr.c
addr.h
bcast.c
bcast.h
bearer.c	net: rename reference+tracking helpers	2022-06-09 21:52:55 -07:00
bearer.h
core.c	tipc: fix use-after-free Read in tipc_named_reinit	2022-06-17 11:39:10 +01:00
core.h
crypto.c	tipc: re-fetch skb cb after tipc_msg_validate	2022-11-28 18:07:31 -08:00
crypto.h
diag.c
discover.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
discover.h
eth_media.c
group.c
group.h
ib_media.c
Kconfig
link.c	tipc: Fix potential OOB in tipc_link_proto_rcv()	2022-12-06 12:58:38 +01:00
link.h
Makefile
monitor.c	treewide: Convert del_timer*() to timer_shutdown*()	2022-12-25 13:38:09 -08:00
monitor.h
msg.c
msg.h
name_distr.c	net/tipc: Remove unused struct distr_queue_item	2022-09-29 18:48:32 -07:00
name_distr.h
name_table.c	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
name_table.h	tipc: cleanup unused function	2022-06-17 11:43:57 +01:00
net.c
net.h
netlink.c	genetlink: start to validate reserved header bytes	2022-08-29 12:47:15 +01:00
netlink.h
netlink_compat.c	tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header	2022-11-07 19:53:40 -08:00
node.c	tipc: fix unexpected link reset due to discovery messages	2023-01-06 12:53:10 +00:00
node.h
socket.c	tipc: fix kernel warning when sending SYN message	2023-02-14 20:46:24 -08:00
socket.h
subscr.c
subscr.h
sysctl.c
topsrv.c	iov_iter work; most of that is about getting rid of	2022-12-12 18:29:54 -08:00
topsrv.h
trace.c
trace.h
udp_media.c
udp_media.h