• Eric Dumazet's avatar
    tcp: cleanup copied_seq and urg_data in tcp_disconnect · 6508b678
    Eric Dumazet authored
    tcp_zerocopy_receive() relies on tcp_inq() to limit number of bytes
    requested by user.
    
    syzbot found that after tcp_disconnect(), tcp_inq() was returning
    a stale value (number of bytes in queue before the disconnect).
    
    Note that after this patch, ioctl(fd, SIOCINQ, &val) is also fixed
    and returns 0, so this might be a candidate for all known linux kernels.
    
    While we are at this, we probably also should clear urg_data to
    avoid other syzkaller reports after it discovers how to deal with
    urgent data.
    
    syzkaller repro :
    
    socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3
    bind(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("224.0.0.1")}, 16) = 0
    connect(3, {sa_family=AF_INET, sin_port=htons(20000), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
    send(3, ..., 4096, 0) = 4096
    connect(3, {sa_family=AF_UNSPEC, sa_data="\0\0\0\0\0\0\0\0\0\0\0\0\0\0"}, 128) = 0
    getsockopt(3, SOL_TCP, TCP_ZEROCOPY_RECEIVE, ..., [16]) = 0 // CRASH
    
    Fixes: 05255b82 ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    6508b678
tcp.c 99.3 KB