Jakub Kicinski
683916f6a8
net/tls: fix sk_msg trim on fallback to copy mode ...
sk_msg_trim() tries to only update curr pointer if it falls into
the trimmed region. The logic, however, does not take into the
account pointer wrapping that sk_msg_iter_var_prev() does nor
(as John points out) the fact that msg->sg is a ring buffer.
This means that when the message was trimmed completely, the new
curr pointer would have the value of MAX_MSG_FRAGS - 1, which is
neither smaller than any other value, nor would it actually be
correct.
Special case the trimming to 0 length a little bit and rework
the comparison between curr and end to take into account wrapping.
This bug caused the TLS code to not copy all of the message, if
zero copy filled in fewer sg entries than memcopy would need.
Big thanks to Alexander Potapenko for the non-KMSAN reproducer.
v2:
- take into account that msg->sg is a ring buffer (John).
Link: https://lore.kernel.org/netdev/20191030160542.30295-1-jakub.kicinski@netronome.com/ (v1)
Fixes: d829e9c411syzbot+f8495bff23a879a6d0bd@syzkaller.appspotmail.com
Reported-by: syzbot+6f50c99e8f6194bf363f@syzkaller.appspotmail.com
Co-developed-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-11-05 18:07:47 -08:00
gpiolib: Initialize the hardware with a callback
2019-10-15 01:18:46 +02:00
net/mlx5: Fix flow counter list auto bits struct
2019-10-29 16:27:17 -07:00
dmaengine: imx-sdma: fix size check for sdma script_number
2019-10-14 13:33:44 +05:30
SUNRPC: Destroy the back channel when we destroy the host transport
2019-10-30 12:04:35 -04:00
bitmap.h: fix kernel-doc warning and typo
2019-10-14 15:04:01 -07:00
bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}()
2019-10-31 21:41:33 +01:00
compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use
2019-10-11 09:26:05 -07:00
cpufreq: Use per-policy frequency QoS
2019-10-21 02:05:21 +02:00
dynamic_debug: provide dynamic_hex_dump stub
2019-10-22 12:54:44 -07:00
x86, efi: Never relocate kernel below lowest acceptable address
2019-10-31 09:40:19 +01:00
symbol namespaces: revert to previous __ksymtab name scheme
2019-10-18 15:32:52 +02:00
bpf: Fix use after free in subprog's jited symbol removal
2019-10-22 11:26:09 -07:00
net: fix sk_page_frag() recursion from memory reclaim
2019-10-28 16:17:31 -07:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
team: fix nested locking lockdep warning
2019-10-24 14:53:48 -07:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
net: phy: micrel: Update KSZ87xx PHY name
2019-10-17 16:31:52 -07:00
net: remove unnecessary variables and callback
2019-10-24 14:53:49 -07:00
mm, page_owner: rename flag indicating that page is allocated
2019-10-14 15:04:00 -07:00
perf/headers: Fix spelling s/EACCESS/EACCES/, s/privilidge/privilege/
2019-10-28 11:02:01 +01:00
PM: QoS: Drop frequency QoS types from device PM QoS
2019-10-21 02:05:21 +02:00
arm64: entry.S: Do not preempt from IRQ before all cpufeatures are enabled
2019-10-16 09:51:43 -07:00
efi/efi_test: Lock down /dev/efi_test and require CAP_SYS_ADMIN
2019-10-31 09:40:21 +01:00
net: add skb_queue_empty_lockless()
2019-10-28 13:33:41 -07:00
net/tls: fix sk_msg trim on fallback to copy mode
2019-11-05 18:07:47 -08:00
net: increase SOMAXCONN to 4096
2019-10-31 14:01:40 -07:00
tcp: add rcu protection around tp->fastopen_rsk
2019-10-13 10:13:08 -07:00
vsock/virtio: remove unused 'work' field from 'struct virtio_vsock_pkt'
2019-10-28 04:25:04 -04:00
xarray.h: fix kernel-doc warning
2019-10-14 15:04:01 -07:00
