]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
net/tls: fix sk_msg trim on fallback to copy mode
authorJakub Kicinski <jakub.kicinski@netronome.com>
Mon, 4 Nov 2019 23:36:57 +0000 (15:36 -0800)
committerDavid S. Miller <davem@davemloft.net>
Wed, 6 Nov 2019 02:07:47 +0000 (18:07 -0800)
commit683916f6a84023407761d843048f1aea486b2612
tree909645fe5abf23144bbb2687c2216f39a6ed0eba
parent57d0f00dfeb3775eae88af1c4aeda6bd35943f20
net/tls: fix sk_msg trim on fallback to copy mode

sk_msg_trim() tries to only update curr pointer if it falls into
the trimmed region. The logic, however, does not take into the
account pointer wrapping that sk_msg_iter_var_prev() does nor
(as John points out) the fact that msg->sg is a ring buffer.

This means that when the message was trimmed completely, the new
curr pointer would have the value of MAX_MSG_FRAGS - 1, which is
neither smaller than any other value, nor would it actually be
correct.

Special case the trimming to 0 length a little bit and rework
the comparison between curr and end to take into account wrapping.

This bug caused the TLS code to not copy all of the message, if
zero copy filled in fewer sg entries than memcopy would need.

Big thanks to Alexander Potapenko for the non-KMSAN reproducer.

v2:
 - take into account that msg->sg is a ring buffer (John).

Link: https://lore.kernel.org/netdev/20191030160542.30295-1-jakub.kicinski@netronome.com/
Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface")
Reported-by: syzbot+f8495bff23a879a6d0bd@syzkaller.appspotmail.com
Reported-by: syzbot+6f50c99e8f6194bf363f@syzkaller.appspotmail.com
Co-developed-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/skmsg.h
net/core/skmsg.c