* [PATCH net] tcp: repair: fix TCP_QUEUE_SEQ implementation
@ 2020-03-19 2:21 Eric Dumazet
2020-03-23 20:03 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Eric Dumazet @ 2020-03-19 2:21 UTC (permalink / raw)
To: David S . Miller; +Cc: netdev, Eric Dumazet, Eric Dumazet, syzbot
When application uses TCP_QUEUE_SEQ socket option to
change tp->rcv_next, we must also update tp->copied_seq.
Otherwise, stuff relying on tcp_inq() being precise can
eventually be confused.
For example, tcp_zerocopy_receive() might crash because
it does not expect tcp_recv_skb() to return NULL.
We could add tests in various places to fix the issue,
or simply make sure tcp_inq() wont return a random value,
and leave fast path as it is.
Note that this fixes ioctl(fd, SIOCINQ, &val) at the same
time.
Fixes: ee9952831cfd ("tcp: Initial repair mode")
Fixes: 05255b823a61 ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
net/ipv4/tcp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index eb2d80519f8e5ad165ca3b8acef2b10bdf8b7345..dc77c303e6f7f69b24170010b6a295d179342676 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2948,8 +2948,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
err = -EPERM;
else if (tp->repair_queue == TCP_SEND_QUEUE)
WRITE_ONCE(tp->write_seq, val);
- else if (tp->repair_queue == TCP_RECV_QUEUE)
+ else if (tp->repair_queue == TCP_RECV_QUEUE) {
WRITE_ONCE(tp->rcv_nxt, val);
+ WRITE_ONCE(tp->copied_seq, val);
+ }
else
err = -EINVAL;
break;
--
2.25.1.481.gfbce0eb801-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] tcp: repair: fix TCP_QUEUE_SEQ implementation
2020-03-19 2:21 [PATCH net] tcp: repair: fix TCP_QUEUE_SEQ implementation Eric Dumazet
@ 2020-03-23 20:03 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2020-03-23 20:03 UTC (permalink / raw)
To: edumazet; +Cc: netdev, eric.dumazet, syzkaller
From: Eric Dumazet <edumazet@google.com>
Date: Wed, 18 Mar 2020 19:21:02 -0700
> When application uses TCP_QUEUE_SEQ socket option to
> change tp->rcv_next, we must also update tp->copied_seq.
>
> Otherwise, stuff relying on tcp_inq() being precise can
> eventually be confused.
>
> For example, tcp_zerocopy_receive() might crash because
> it does not expect tcp_recv_skb() to return NULL.
>
> We could add tests in various places to fix the issue,
> or simply make sure tcp_inq() wont return a random value,
> and leave fast path as it is.
>
> Note that this fixes ioctl(fd, SIOCINQ, &val) at the same
> time.
>
> Fixes: ee9952831cfd ("tcp: Initial repair mode")
> Fixes: 05255b823a61 ("tcp: add TCP_ZEROCOPY_RECEIVE support for zerocopy receive")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
Applied and queued up for -stable, thanks Eric.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-03-23 20:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-19 2:21 [PATCH net] tcp: repair: fix TCP_QUEUE_SEQ implementation Eric Dumazet
2020-03-23 20:03 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.