Eric Dumazet d4ebd0fc93 tcp: fix error recovery in tcp_zerocopy_receive() ... [ Upstream commit e776af608f ] If user provides wrong virtual address in TCP_ZEROCOPY_RECEIVE operation we want to return -EINVAL error. But depending on zc->recv_skip_hint content, we might return -EIO error if the socket has SOCK_DONE set. Make sure to return -EINVAL in this case. BUG: KMSAN: uninit-value in tcp_zerocopy_receive net/ipv4/tcp.c:1833 [inline] BUG: KMSAN: uninit-value in do_tcp_getsockopt+0x4494/0x6320 net/ipv4/tcp.c:3685 CPU: 1 PID: 625 Comm: syz-executor.0 Not tainted 5.7.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x220 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:215 tcp_zerocopy_receive net/ipv4/tcp.c:1833 [inline] do_tcp_getsockopt+0x4494/0x6320 net/ipv4/tcp.c:3685 tcp_getsockopt+0xf8/0x1f0 net/ipv4/tcp.c:3728 sock_common_getsockopt+0x13f/0x180 net/core/sock.c:3131 __sys_getsockopt+0x533/0x7b0 net/socket.c:2177 __do_sys_getsockopt net/socket.c:2192 [inline] __se_sys_getsockopt+0xe1/0x100 net/socket.c:2189 __x64_sys_getsockopt+0x62/0x80 net/socket.c:2189 do_syscall_64+0xb8/0x160 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45c829 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f1deeb72c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 00000000004e01e0 RCX: 000000000045c829 RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000009 RBP: 000000000078bf00 R08: 0000000020000200 R09: 0000000000000000 R10: 00000000200001c0 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000001d8 R14: 00000000004d3038 R15: 00007f1deeb736d4 Local variable ----zc@do_tcp_getsockopt created at: do_tcp_getsockopt+0x1a74/0x6320 net/ipv4/tcp.c:3670 do_tcp_getsockopt+0x1a74/0x6320 net/ipv4/tcp.c:3670 Fixes: 05255b823a ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Acked-by: Soheil Hassas Yeganeh <soheil@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2020-05-20 08:18:36 +02:00
..
6lowpan	6lowpan: Off by one handling ->nexthdr	2020-01-27 14:50:41 +01:00
9p	9p: Transport error uninitialized	2019-10-11 18:21:12 +02:00
802
8021q	vlan: vlan_changelink() should propagate errors	2020-01-12 12:17:28 +01:00
appletalk	appletalk: Set error code if register_snap_client failed	2019-12-13 08:52:59 +01:00
atm	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
ax25	ax25: enforce CAP_NET_RAW for raw sockets	2019-10-05 13:09:32 +02:00
batman-adv	batman-adv: Fix refcnt leak in batadv_v_ogm_process	2020-05-14 07:57:22 +02:00
bluetooth	Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl	2020-04-13 10:45:14 +02:00
bpf	bpf/test_run: support cgroup local storage	2018-08-03 00:47:32 +02:00
bpfilter	signal/bpfilter: Fix bpfilter_kernl to use send_sig not force_sig	2020-01-27 14:50:51 +01:00
bridge	netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last rule	2020-01-27 14:50:47 +01:00
caif	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
can	can: gw: Fix error path of cgw_module_init	2019-08-29 08:28:30 +02:00
ceph	ceph: check POOL_FLAG_FULL/NEARFULL in addition to OSDMAP_FULL/NEARFULL	2020-04-02 15:28:16 +02:00
core	net: fix a potential recursive NETDEV_FEAT_CHANGE	2020-05-20 08:18:35 +02:00
dcb	net: dcb: Add priority-to-DSCP map getters	2018-07-27 13:17:50 -07:00
dccp	net: ipv6: add net argument to ip6_dst_lookup_flow	2020-04-29 16:31:16 +02:00
decnet	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2020-01-04 19:13:37 +01:00
dns_resolver	KEYS: Don't write out to userspace while holding key semaphore	2020-04-23 10:30:24 +02:00
dsa	net: dsa: Do not make user port errors fatal	2020-05-20 08:18:32 +02:00
ethernet	net: add annotations on hh->hh_len lockless accesses	2020-01-09 10:19:09 +01:00
hsr	hsr: check protocol version in hsr_newlink()	2020-04-21 09:03:03 +02:00
ieee802154	nl802154: add missing attribute validation for dev_type	2020-03-18 07:14:15 +01:00
ife
ipv4	tcp: fix error recovery in tcp_zerocopy_receive()	2020-05-20 08:18:36 +02:00
ipv6	Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"	2020-05-20 08:18:36 +02:00
iucv	net/af_iucv: always register net_device notifier	2020-01-27 14:50:56 +01:00
kcm	kcm: switch order of device registration to fix a crash	2019-04-17 08:38:40 +02:00
key	af_key: fix leaks in key_pol_get_resp and dump_sp.	2019-07-26 09:14:01 +02:00
l2tp	net: ipv6: add net argument to ip6_dst_lookup_flow	2020-04-29 16:31:16 +02:00
l3mdev
lapb	lapb: fixed leak of control-blocks.	2019-06-22 08:15:13 +02:00
llc	llc: fix sk_buff refcounting in llc_conn_state_process()	2020-01-27 14:51:17 +01:00
mac80211	mac80211: add ieee80211_is_any_nullfunc()	2020-05-10 10:30:12 +02:00
mac802154	net: mac802154: tx: expand tailroom if necessary	2018-08-06 11:21:37 +02:00
mpls	net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup	2020-04-29 16:31:17 +02:00
ncsi	net/ncsi: Fixup .dumpit message flags and ID check in Netlink handler	2018-08-22 21:39:08 -07:00
netfilter	netfilter: nf_osf: avoid passing pointer to local var	2020-05-14 07:57:23 +02:00
netlabel	netlabel: cope with NULL catmap	2020-05-20 08:18:35 +02:00
netlink	netlink: Use netlink header as base to calculate bad attribute offset	2020-03-18 07:14:12 +01:00
netrom	net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node	2020-04-29 16:31:21 +02:00
nfc	nfc: add missing attribute validation for vendor subcommand	2020-03-18 07:14:17 +01:00
nsh	nsh: set mac len based on inner packet	2018-07-12 16:55:29 -07:00
openvswitch	openvswitch: support asymmetric conntrack	2019-12-21 10:57:14 +01:00
packet	net/packet: tpacket_rcv: avoid a producer race condition	2020-04-02 15:28:11 +02:00
phonet	net: use skb_queue_empty_lockless() in poll() handlers	2019-11-10 11:27:48 +01:00
psample	net: psample: fix skb_over_panic	2019-12-05 09:21:30 +01:00
qrtr	net: qrtr: send msgs from local of same id as broadcast	2020-04-21 09:03:04 +02:00
rds	net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names'	2020-01-27 14:51:13 +01:00
rfkill	rfkill: Fix incorrect check to avoid NULL pointer dereference	2020-01-12 12:17:17 +01:00
rose	net/rose: fix unbound loop in rose_loopback_timer()	2019-05-02 09:59:00 +02:00
rxrpc	rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket	2020-05-02 17:25:51 +02:00
sched	sch_sfq: validate silly quantum values	2020-05-14 07:57:18 +02:00
sctp	sctp: Fix bundling of SHUTDOWN with COOKIE-ACK	2020-05-14 07:57:20 +02:00
smc	net/smc: cancel event worker during device removal	2020-03-18 07:14:25 +01:00
strparser	net: strparser: partially revert "strparser: Call skb_unclone conditionally"	2019-05-16 19:41:27 +02:00
sunrpc	svcrdma: Fix leak of svc_rdma_recv_ctxt objects	2020-05-02 17:25:52 +02:00
switchdev
tipc	tipc: fix partial topology connection closure	2020-05-14 07:57:18 +02:00
tls	net/tls: Fix to avoid gettig invalid tls record	2020-03-05 16:42:17 +01:00
unix	af_unix: add compat_ioctl support	2020-01-17 19:47:07 +01:00
vmw_vsock	hv_sock: Remove the accept port restriction	2020-02-14 16:33:22 -05:00
wimax	wimax: remove blank lines at EOF	2018-07-24 14:10:42 -07:00
wireless	nl80211: fix NL80211_ATTR_CHANNEL_WIDTH attribute type	2020-04-02 15:28:17 +02:00
x25	net/x25: Fix x25_neigh refcnt leak when receiving frame	2020-04-29 16:31:21 +02:00
xdp	xsk: Add missing check on user supplied headroom size	2020-04-23 10:30:15 +02:00
xfrm	xfrm: policy: Fix doulbe free in xfrm_policy_timer	2020-04-02 15:28:19 +02:00
compat.c	sock: Make sock->sk_stamp thread-safe	2019-01-09 17:38:33 +01:00
Kconfig	net: remove blank lines at end of file	2018-07-24 14:10:43 -07:00
Makefile
socket.c	compat_ioctl: handle SIOCOUTQNSD	2020-01-17 19:47:07 +01:00
sysctl_net.c