• WANG Cong's avatar
    kcm: fix 0-length case for kcm_sendmsg() · 98e3862c
    WANG Cong authored
    Dmitry reported a kernel warning:
    
     WARNING: CPU: 3 PID: 2936 at net/kcm/kcmsock.c:627
     kcm_write_msgs+0x12e3/0x1b90 net/kcm/kcmsock.c:627
     CPU: 3 PID: 2936 Comm: a.out Not tainted 4.10.0-rc6+ #209
     Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
     Call Trace:
      __dump_stack lib/dump_stack.c:15 [inline]
      dump_stack+0x2ee/0x3ef lib/dump_stack.c:51
      panic+0x1fb/0x412 kernel/panic.c:179
      __warn+0x1c4/0x1e0 kernel/panic.c:539
      warn_slowpath_null+0x2c/0x40 kernel/panic.c:582
      kcm_write_msgs+0x12e3/0x1b90 net/kcm/kcmsock.c:627
      kcm_sendmsg+0x163a/0x2200 net/kcm/kcmsock.c:1029
      sock_sendmsg_nosec net/socket.c:635 [inline]
      sock_sendmsg+0xca/0x110 net/socket.c:645
      sock_write_iter+0x326/0x600 net/socket.c:848
      new_sync_write fs/read_write.c:499 [inline]
      __vfs_write+0x483/0x740 fs/read_write.c:512
      vfs_write+0x187/0x530 fs/read_write.c:560
      SYSC_write fs/read_write.c:607 [inline]
      SyS_write+0xfb/0x230 fs/read_write.c:599
      entry_SYSCALL_64_fastpath+0x1f/0xc2
    
    when calling syscall(__NR_write, sock2, 0x208aaf27ul, 0x0ul) on a KCM
    seqpacket socket. It appears that kcm_sendmsg() does not handle len==0
    case correctly, which causes an empty skb is allocated and queued.
    Fix this by skipping the skb allocation for len==0 case.
    Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
    Cc: Tom Herbert <tom@herbertland.com>
    Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    98e3862c
kcmsock.c 44.8 KB