Commit 3c5a2fd0 authored by Arjun Roy's avatar Arjun Roy Committed by David S. Miller

tcp: Sanitize CMSG flags and reserved args in tcp_zerocopy_receive.

Explicitly define reserved field and require it and any subsequent
fields to be zero-valued for now. Additionally, limit the valid CMSG
flags that tcp_zerocopy_receive accepts.

Fixes: 7eeba170 ("tcp: Add receive timestamp support for receive zerocopy.")
Signed-off-by: default avatarArjun Roy <arjunroy@google.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
Suggested-by: default avatarDavid Ahern <dsahern@gmail.com>
Suggested-by: default avatarLeon Romanovsky <leon@kernel.org>
Suggested-by: default avatarJakub Kicinski <kuba@kernel.org>
Acked-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9fbb4a7a
......@@ -357,6 +357,6 @@ struct tcp_zerocopy_receive {
__u64 msg_control; /* ancillary data */
__u64 msg_controllen;
__u32 msg_flags;
/* __u32 hole; Next we must add >1 u32 otherwise length checks fail. */
__u32 reserved; /* set to 0 for now */
};
#endif /* _UAPI_LINUX_TCP_H */
......@@ -2030,6 +2030,7 @@ static int tcp_zerocopy_vm_insert_batch(struct vm_area_struct *vma,
err);
}
#define TCP_VALID_ZC_MSG_FLAGS (TCP_CMSG_TS)
static void tcp_recv_timestamp(struct msghdr *msg, const struct sock *sk,
struct scm_timestamping_internal *tss);
static void tcp_zc_finalize_rx_tstamp(struct sock *sk,
......@@ -4152,13 +4153,21 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
return -EFAULT;
if (len < offsetofend(struct tcp_zerocopy_receive, length))
return -EINVAL;
if (len > sizeof(zc)) {
if (unlikely(len > sizeof(zc))) {
err = check_zeroed_user(optval + sizeof(zc),
len - sizeof(zc));
if (err < 1)
return err == 0 ? -EINVAL : err;
len = sizeof(zc);
if (put_user(len, optlen))
return -EFAULT;
}
if (copy_from_user(&zc, optval, len))
return -EFAULT;
if (zc.reserved)
return -EINVAL;
if (zc.msg_flags & ~(TCP_VALID_ZC_MSG_FLAGS))
return -EINVAL;
lock_sock(sk);
err = tcp_zerocopy_receive(sk, &zc, &tss);
release_sock(sk);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment