Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/net
History
Cong Wang 3434278976 tcp_bpf: fix return value of tcp_bpf_sendmsg() 
[ Upstream commit fe1910f9337bd46a9343967b547ccab26b4b2c6e ]

When we cork messages in psock->cork, the last message triggers the
flushing will result in sending a sk_msg larger than the current
message size. In this case, in tcp_bpf_send_verdict(), 'copied' becomes
negative at least in the following case:

468         case __SK_DROP:
469         default:
470                 sk_msg_free_partial(sk, msg, tosend);
471                 sk_msg_apply_bytes(psock, tosend);
472                 *copied -= (tosend + delta); // <==== HERE
473                 return -EACCES;

Therefore, it could lead to the following BUG with a proper value of
'copied' (thanks to syzbot). We should not use negative 'copied' as a
return value here.

  ------------[ cut here ]------------
  kernel BUG at net/socket.c:733!
  Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
  Modules linked in:
  CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0
  Hardware name: linux,dummy-virt (DT)
  pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
  pc : sock_sendmsg_nosec net/socket.c:733 [inline]
  pc : sock_sendmsg_nosec net/socket.c:728 [inline]
  pc : __sock_sendmsg+0x5c/0x60 net/socket.c:745
  lr : sock_sendmsg_nosec net/socket.c:730 [inline]
  lr : __sock_sendmsg+0x54/0x60 net/socket.c:745
  sp : ffff800088ea3b30
  x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000
  x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000
  x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90
  x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001
  x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf
  x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000
  x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0
  x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000
  x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900
  x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef
  Call trace:
   sock_sendmsg_nosec net/socket.c:733 [inline]
   __sock_sendmsg+0x5c/0x60 net/socket.c:745
   ____sys_sendmsg+0x274/0x2ac net/socket.c:2597
   ___sys_sendmsg+0xac/0x100 net/socket.c:2651
   __sys_sendmsg+0x84/0xe0 net/socket.c:2680
   __do_sys_sendmsg net/socket.c:2689 [inline]
   __se_sys_sendmsg net/socket.c:2687 [inline]
   __arm64_sys_sendmsg+0x24/0x30 net/socket.c:2687
   __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
   invoke_syscall+0x48/0x110 arch/arm64/kernel/syscall.c:49
   el0_svc_common.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132
   do_el0_svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151
   el0_svc+0x34/0xec arch/arm64/kernel/entry-common.c:712
   el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:730
   el0t_64_sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598
  Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000)
  ---[ end trace 0000000000000000 ]---

Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socket TX/RX data")
Reported-by: syzbot+58c03971700330ce14d8@syzkaller.appspotmail.com
Cc: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://patch.msgid.link/20240821030744.320934-1-xiyou.wangcong@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-23 23:21:04 +01:00
..
6lowpan
9p net/9p: fix uninit-value in p9_client_rpc() 2024-11-19 12:27:18 +01:00
802
8021q vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING 2024-11-18 12:13:00 +01:00
appletalk
atm
ax25
batman-adv batman-adv: fix random jitter calculation 2024-11-19 17:55:48 +01:00
bluetooth Bluetooth: MGMT: Ignore keys being loaded with invalid type 2024-11-23 23:21:00 +01:00
bpf
bpfilter
bridge net: bridge: fix multicast-to-unicast with fraglist GSO 2024-11-19 11:32:43 +01:00
caif
can can: bcm: Remove proc entry when dev is unregistered. 2024-11-23 23:21:03 +01:00
ceph libceph: fix race between delayed_work() and ceph_monc_stop() 2024-11-19 14:19:45 +01:00
core bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode 2024-11-23 23:20:59 +01:00
dcb
dccp
decnet
dns_resolver keys, dns: Fix size check of V1 server-list header 2024-11-18 12:12:43 +01:00
dsa
ethernet ethernet: Add helper for assigning packet type when dest address does not match device address 2024-11-19 11:32:39 +01:00
ethtool ethtool: check device is present when getting link settings 2024-11-23 23:20:55 +01:00
hsr hsr: Handle failures in module init 2024-11-19 08:44:59 +01:00
ieee802154
ife
ipv4 tcp_bpf: fix return value of tcp_bpf_sendmsg() 2024-11-23 23:21:04 +01:00
ipv6 ila: call nf_unregister_net_hooks() sooner 2024-11-23 23:21:00 +01:00
iucv s390/iucv: fix receive buffer virtual vs physical address confusion 2024-11-23 23:20:47 +01:00
kcm kcm: Serialise kcm_sendmsg() for the same socket. 2024-11-23 23:20:48 +01:00
key
l2tp l2tp: fix lockdep splat 2024-11-23 23:20:22 +01:00
l3mdev
lapb
llc llc: call sock_orphan() at release time 2024-11-18 12:13:22 +01:00
mac80211 wifi: mac80211: fix BA session teardown race 2024-11-23 23:20:44 +01:00
mac802154 Revert "net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()" 2024-11-19 14:52:14 +01:00
mpls
mptcp mptcp: pm: avoid possible UaF when selecting endp 2024-11-23 23:21:01 +01:00
ncm
ncsi net/ncsi: Fix the multi thread manner of NCSI driver 2024-11-19 14:19:00 +01:00
netfilter netfilter: nf_conncount: fix wrong variable type 2024-11-23 23:21:03 +01:00
netlabel calipso: fix memory leak in netlbl_calipso_add_pass() 2024-11-18 12:12:25 +01:00
netlink netlink: hold nlk->cb_mutex longer in __netlink_dump_start() 2024-11-23 23:20:45 +01:00
netrom netrom: Fix a memory leak in nr_heartbeat_expiry() 2024-11-19 14:19:08 +01:00
nfc nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() 2024-11-19 12:27:10 +01:00
nsh nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). 2024-11-19 11:32:42 +01:00
openvswitch openvswitch: Set the skbuff pkt_type for proper pmtud support. 2024-11-19 12:27:09 +01:00
packet af_packet: Handle outgoing VLAN packets without hardware offloading 2024-11-23 23:20:12 +01:00
phonet phonet: fix rtm_phonet_notify() skb allocation 2024-11-19 11:32:46 +01:00
psample
qrtr
rds net:rds: Fix possible deadlock in rds_message_put 2024-11-23 23:20:54 +01:00
rfkill net: rfkill: gpio: set GPIO direction 2024-11-18 12:12:01 +01:00
rose
rxrpc rxrpc: Fix response to PING RESPONSE ACKs to a dead call 2024-11-18 12:13:25 +01:00
sched sched: sch_cake: fix bulk flow accounting logic for host fairness 2024-11-23 23:21:01 +01:00
sctp sctp: Fix null-ptr-deref in reuseport_add_sock(). 2024-11-23 23:20:22 +01:00
skb_tracer
smc net/smc: set rmb's SG_MAX_SINGLE_ALLOC limitation only when CONFIG_ARCH_NO_SG_CHAIN is defined 2024-11-23 23:20:06 +01:00
strparser
sunrpc svcrdma: Catch another Reply chunk overflow case 2024-11-23 23:21:04 +01:00
switchdev
tipc tipc: Return non-zero value from tipc_udp_addr2str() on error 2024-11-23 23:20:17 +01:00
tls tls: fix missing memory barrier in tls_init 2024-11-19 12:27:09 +01:00
unix af_unix: Remove put_pid()/put_cred() in copy_peercred(). 2024-11-23 23:21:03 +01:00
vmw_vsock virtio/vsock: fix logic which reduces credit update messages 2024-11-18 12:12:37 +01:00
wimax
wireless wifi: cfg80211: make hash table duplicates more survivable 2024-11-23 23:20:58 +01:00
x25 net/x25: fix incorrect parameter validation in the x25_getsockopt() function 2024-11-19 08:44:50 +01:00
xdp xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING 2024-11-19 11:32:19 +01:00
xfrm net: fix __dst_negative_advice() race 2024-11-19 12:27:19 +01:00
compat.c
devres.c
Kconfig
Makefile
socket.c net: Save and restore msg_namelen in sock_sendmsg 2024-11-18 12:12:07 +01:00
sysctl_net.c
TEST_MAPPING