From patchwork Wed Jun 14 08:04:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Howells X-Patchwork-Id: 107801 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp1076138vqr; Wed, 14 Jun 2023 01:12:58 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7Ug/4i1ZHk1IXD8htbEz3B/uWcHXU9Bcn9wKmfKcnfqg/VUdOVzCimckG60OiXPG/cbGhJ X-Received: by 2002:a17:907:9805:b0:94a:4e86:31bc with SMTP id ji5-20020a170907980500b0094a4e8631bcmr878103ejc.13.1686730378486; Wed, 14 Jun 2023 01:12:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1686730378; cv=none; d=google.com; s=arc-20160816; b=Tqxkf5SriGyNleyM0g19UMVRg6PyA+tIvX/s6sHADPeRTwHUs7eIK09Eme1R/Q3D7v ba55BWkUGpAFHGWFlqvyeeT+848q/2NM7+KbUel3i60Vg/4eMn0TVN/6/Z3MrSHTH/a5 eQNF67FKDL9iBDXy7DJUjxo+iGNKvcPQFID5p+7sT9UbUJv4CnrMKMFbjMpaLfbaJRX0 6gzdz+mVZ+ouWblopAYH4aVPZg6yAtILt+ua30nC+7NlR9zTUmo8DuXGgA8bSaaDZliF swUZ4s32O/Q5vdTZPtBGFUwrz6gsqTKmpz0n7PFBoKG3YgC6Cg+h78jwaiq5HbSyxXwX Qr8w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:message-id:date:content-transfer-encoding :content-id:mime-version:subject:cc:to:from:organization :dkim-signature; bh=AdExDkio2IavDiEBIZ3Za2q9aIwRCw4IZu4sfOZDrT0=; b=itDdrDGtWTXRVR0O076WmxHRS5WkgCITi8NR0oHfMYG6YKUcVGqH1Tvbkfqpd2Yv+a gtn7chOdZaqgjxa1s3UCMMScgz7tXYlXVI8oOL/JvK46K4RQJDzJ3AM3O1M0LveDQkVD cPyS0teXmxEVAWTkgjg+mnD4F4xDY4VtZLRvPz/6q+jbRHSgSTZlV/BRzmrRKjs1rCyM zUQX089cCAvxROTBzh7DDroYSZf9QAdtZYULcJzK/y0oezoFrChSQNvfg3lmV55UvbNE JzvLTaZXLrpcW1miR4Tc3B/yefkL8oO9ROT+A+4PVkNQDjBZ2nkcNhcQ6IrJN8bNReQo d/JQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=HPTXjx+K; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id u22-20020a1709063b9600b0098276f2be23si305423ejf.741.2023.06.14.01.12.33; Wed, 14 Jun 2023 01:12:58 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=HPTXjx+K; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234327AbjFNIF1 (ORCPT + 99 others); Wed, 14 Jun 2023 04:05:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37874 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243677AbjFNIFR (ORCPT ); Wed, 14 Jun 2023 04:05:17 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C64A91FDB for ; Wed, 14 Jun 2023 01:04:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1686729863; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=AdExDkio2IavDiEBIZ3Za2q9aIwRCw4IZu4sfOZDrT0=; b=HPTXjx+KDsQIRVDYcZQCobrVp9k0HiFyCxANsrScJidoq/i7Thk4No6s/2odYBpzOOVHrm oUoYjt0Y4l0Hp84+SOjgrHNtO+A7wOM0rJCTjh8KN7Z9txKIND/8gtQ23HngrcoBkYnVgs TzKt6g1qRY7zmrLkF9wzWjDMt2W5WO8= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-111-ikdS9KTKNjSb28DFQ4X47Q-1; Wed, 14 Jun 2023 04:04:19 -0400 X-MC-Unique: ikdS9KTKNjSb28DFQ4X47Q-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B5793810BB3; Wed, 14 Jun 2023 08:04:18 +0000 (UTC) Received: from warthog.procyon.org.uk (unknown [10.42.28.67]) by smtp.corp.redhat.com (Postfix) with ESMTP id 080E740C6F5C; Wed, 14 Jun 2023 08:04:16 +0000 (UTC) Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells To: netdev@vger.kernel.org cc: dhowells@redhat.com, syzbot+d8486855ef44506fd675@syzkaller.appspotmail.com, Willem de Bruijn , David Ahern , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Jens Axboe , Matthew Wilcox , linux-kernel@vger.kernel.org Subject: [PATCH net-next] ip, ip6: Fix splice to raw and ping sockets MIME-Version: 1.0 Content-ID: <1410155.1686729856.1@warthog.procyon.org.uk> Date: Wed, 14 Jun 2023 09:04:16 +0100 Message-ID: <1410156.1686729856@warthog.procyon.org.uk> X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1768664993278318253?= X-GMAIL-MSGID: =?utf-8?q?1768664993278318253?= Splicing to SOCK_RAW sockets may set MSG_SPLICE_PAGES, but in such a case, __ip_append_data() will call skb_splice_from_iter() to access the 'from' data, assuming it to point to a msghdr struct with an iter, instead of using the provided getfrag function to access it. In the case of raw_sendmsg(), however, this is not the case and 'from' will point to a raw_frag_vec struct and raw_getfrag() will be the frag-getting function. A similar issue may occur with rawv6_sendmsg(). Fix this by ignoring MSG_SPLICE_PAGES if getfrag != ip_generic_getfrag as ip_generic_getfrag() expects "from" to be a msghdr*, but the other getfrags don't. Note that this will prevent MSG_SPLICE_PAGES from being effective for udplite. This likely affects ping sockets too. udplite looks like it should be okay as it expects "from" to be a msghdr. Signed-off-by: David Howells Reported-by: syzbot+d8486855ef44506fd675@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/000000000000ae4cbf05fdeb8349@google.com/ Fixes: 2dc334f1a63a ("splice, net: Use sendmsg(MSG_SPLICE_PAGES) rather than ->sendpage()") Tested-by: syzbot+d8486855ef44506fd675@syzkaller.appspotmail.com cc: Willem de Bruijn cc: David Ahern cc: "David S. Miller" cc: Eric Dumazet cc: Jakub Kicinski cc: Paolo Abeni cc: Jens Axboe cc: Matthew Wilcox cc: netdev@vger.kernel.org Reviewed-by: Willem de Bruijn --- net/ipv4/ip_output.c | 3 ++- net/ipv6/ip6_output.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 244fb9365d87..4b39ea99f00b 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1040,7 +1040,8 @@ static int __ip_append_data(struct sock *sk, } else if ((flags & MSG_SPLICE_PAGES) && length) { if (inet->hdrincl) return -EPERM; - if (rt->dst.dev->features & NETIF_F_SG) + if (rt->dst.dev->features & NETIF_F_SG && + getfrag == ip_generic_getfrag) /* We need an empty buffer to attach stuff to */ paged = true; else diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index c722cb881b2d..dd845139882c 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1592,7 +1592,8 @@ static int __ip6_append_data(struct sock *sk, } else if ((flags & MSG_SPLICE_PAGES) && length) { if (inet_sk(sk)->hdrincl) return -EPERM; - if (rt->dst.dev->features & NETIF_F_SG) + if (rt->dst.dev->features & NETIF_F_SG && + getfrag == ip_generic_getfrag) /* We need an empty buffer to attach stuff to */ paged = true; else