From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Sasha Levin <sashal@kernel.org>, daniel@iogearbox.net, Eric Dumazet <eric.dumazet@gmail.com>, mst@redhat.com, netdev@vger.kernel.org, john.fastabend@gmail.com, ast@kernel.org, virtualization@lists.linux-foundation.org, Harold Huang <baymaxhuang@gmail.com>, kvm@vger.kernel.org, Jakub Kicinski <kuba@kernel.org>, bpf@vger.kernel.org, pabeni@redhat.com, davem@davemloft.net, hawk@kernel.org Subject: [PATCH AUTOSEL 5.4 26/37] tuntap: add sanity checks about msg_controllen in sendmsg Date: Fri, 1 Apr 2022 10:44:35 -0400 [thread overview] Message-ID: <20220401144446.1954694-26-sashal@kernel.org> (raw) In-Reply-To: <20220401144446.1954694-1-sashal@kernel.org> From: Harold Huang <baymaxhuang@gmail.com> [ Upstream commit 74a335a07a17d131b9263bfdbdcb5e40673ca9ca ] In patch [1], tun_msg_ctl was added to allow pass batched xdp buffers to tun_sendmsg. Although we donot use msg_controllen in this path, we should check msg_controllen to make sure the caller pass a valid msg_ctl. [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fe8dd45bb7556246c6b76277b1ba4296c91c2505 Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Suggested-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Harold Huang <baymaxhuang@gmail.com> Acked-by: Jason Wang <jasowang@redhat.com> Link: https://lore.kernel.org/r/20220303022441.383865-1-baymaxhuang@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/net/tap.c | 3 ++- drivers/net/tun.c | 3 ++- drivers/vhost/net.c | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/tap.c b/drivers/net/tap.c index f285422a8071..f870d08bb1f8 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -1214,7 +1214,8 @@ static int tap_sendmsg(struct socket *sock, struct msghdr *m, struct xdp_buff *xdp; int i; - if (ctl && (ctl->type == TUN_MSG_PTR)) { + if (m->msg_controllen == sizeof(struct tun_msg_ctl) && + ctl && ctl->type == TUN_MSG_PTR) { for (i = 0; i < ctl->num; i++) { xdp = &((struct xdp_buff *)ctl->ptr)[i]; tap_get_user_xdp(q, xdp); diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 10211ea60514..d9993884a97d 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -2561,7 +2561,8 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) if (!tun) return -EBADFD; - if (ctl && (ctl->type == TUN_MSG_PTR)) { + if (m->msg_controllen == sizeof(struct tun_msg_ctl) && + ctl && ctl->type == TUN_MSG_PTR) { struct tun_page tpage; int n = ctl->num; int flush = 0; diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index cec9173aac6f..1058aba8d573 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -472,6 +472,7 @@ static void vhost_tx_batch(struct vhost_net *net, goto signal_used; msghdr->msg_control = &ctl; + msghdr->msg_controllen = sizeof(ctl); err = sock->ops->sendmsg(sock, msghdr, 0); if (unlikely(err < 0)) { vq_err(&nvq->vq, "Fail to batch sending packets\n"); -- 2.34.1 _______________________________________________ Virtualization mailing list Virtualization@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/virtualization
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org> To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Harold Huang <baymaxhuang@gmail.com>, Eric Dumazet <eric.dumazet@gmail.com>, Jason Wang <jasowang@redhat.com>, Jakub Kicinski <kuba@kernel.org>, Sasha Levin <sashal@kernel.org>, davem@davemloft.net, pabeni@redhat.com, mst@redhat.com, ast@kernel.org, daniel@iogearbox.net, hawk@kernel.org, john.fastabend@gmail.com, netdev@vger.kernel.org, kvm@vger.kernel.org, virtualization@lists.linux-foundation.org, bpf@vger.kernel.org Subject: [PATCH AUTOSEL 5.4 26/37] tuntap: add sanity checks about msg_controllen in sendmsg Date: Fri, 1 Apr 2022 10:44:35 -0400 [thread overview] Message-ID: <20220401144446.1954694-26-sashal@kernel.org> (raw) In-Reply-To: <20220401144446.1954694-1-sashal@kernel.org> From: Harold Huang <baymaxhuang@gmail.com> [ Upstream commit 74a335a07a17d131b9263bfdbdcb5e40673ca9ca ] In patch [1], tun_msg_ctl was added to allow pass batched xdp buffers to tun_sendmsg. Although we donot use msg_controllen in this path, we should check msg_controllen to make sure the caller pass a valid msg_ctl. [1]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fe8dd45bb7556246c6b76277b1ba4296c91c2505 Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Suggested-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Harold Huang <baymaxhuang@gmail.com> Acked-by: Jason Wang <jasowang@redhat.com> Link: https://lore.kernel.org/r/20220303022441.383865-1-baymaxhuang@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> --- drivers/net/tap.c | 3 ++- drivers/net/tun.c | 3 ++- drivers/vhost/net.c | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/tap.c b/drivers/net/tap.c index f285422a8071..f870d08bb1f8 100644 --- a/drivers/net/tap.c +++ b/drivers/net/tap.c @@ -1214,7 +1214,8 @@ static int tap_sendmsg(struct socket *sock, struct msghdr *m, struct xdp_buff *xdp; int i; - if (ctl && (ctl->type == TUN_MSG_PTR)) { + if (m->msg_controllen == sizeof(struct tun_msg_ctl) && + ctl && ctl->type == TUN_MSG_PTR) { for (i = 0; i < ctl->num; i++) { xdp = &((struct xdp_buff *)ctl->ptr)[i]; tap_get_user_xdp(q, xdp); diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 10211ea60514..d9993884a97d 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -2561,7 +2561,8 @@ static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) if (!tun) return -EBADFD; - if (ctl && (ctl->type == TUN_MSG_PTR)) { + if (m->msg_controllen == sizeof(struct tun_msg_ctl) && + ctl && ctl->type == TUN_MSG_PTR) { struct tun_page tpage; int n = ctl->num; int flush = 0; diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index cec9173aac6f..1058aba8d573 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -472,6 +472,7 @@ static void vhost_tx_batch(struct vhost_net *net, goto signal_used; msghdr->msg_control = &ctl; + msghdr->msg_controllen = sizeof(ctl); err = sock->ops->sendmsg(sock, msghdr, 0); if (unlikely(err < 0)) { vq_err(&nvq->vq, "Fail to batch sending packets\n"); -- 2.34.1
next prev parent reply other threads:[~2022-04-01 14:45 UTC|newest] Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-04-01 14:44 [PATCH AUTOSEL 5.4 01/37] drm: Add orientation quirk for GPD Win Max Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 02/37] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 03/37] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 04/37] ptp: replace snprintf with sysfs_emit Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 05/37] powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 06/37] bpf: Make dst_port field in struct bpf_sock 16-bit wide Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 07/37] scsi: mvsas: Replace snprintf() with sysfs_emit() Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 08/37] scsi: bfa: " Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 09/37] power: supply: axp20x_battery: properly report current when discharging Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 10/37] ipv6: make mc_forwarding atomic Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 11/37] powerpc: Set crashkernel offset to mid of RMA region Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 12/37] drm/amdgpu: Fix recursive locking warning Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 13/37] PCI: aardvark: Fix support for MSI interrupts Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 14/37] iommu/arm-smmu-v3: fix event handling soft lockup Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 15/37] usb: ehci: add pci device support for Aspeed platforms Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 16/37] PCI: pciehp: Add Qualcomm quirk for Command Completed erratum Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 17/37] power: supply: axp288-charger: Set Vhold to 4.4V Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 18/37] ipv4: Invalidate neighbour for broadcast address upon address addition Sasha Levin 2022-04-01 14:44 ` [dm-devel] [PATCH AUTOSEL 5.4 19/37] dm ioctl: prevent potential spectre v1 gadget Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 20/37] drm/amdkfd: make CRAT table missing message informational only Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 21/37] scsi: pm8001: Fix pm8001_mpi_task_abort_resp() Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 22/37] scsi: aha152x: Fix aha152x_setup() __setup handler return value Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 23/37] net/smc: correct settings of RMB window update limit Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 24/37] mips: ralink: fix a refcount leak in ill_acc_of_setup() Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 25/37] macvtap: advertise link netns via netlink Sasha Levin 2022-04-01 14:44 ` Sasha Levin [this message] 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 26/37] tuntap: add sanity checks about msg_controllen in sendmsg Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 27/37] iommu/iova: Improve 32-bit free space estimate Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 28/37] bnxt_en: Eliminate unintended link toggle during FW reset Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 29/37] MIPS: fix fortify panic when copying asm exception handlers Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 30/37] powerpc/code-patching: Pre-map patch area Sasha Levin 2022-04-01 14:44 ` Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 31/37] scsi: libfc: Fix use after free in fc_exch_abts_resp() Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 32/37] usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 33/37] xtensa: fix DTC warning unit_address_format Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 34/37] Bluetooth: Fix use after free in hci_send_acl Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 35/37] netlabel: fix out-of-bounds memory accesses Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 36/37] init/main.c: return 1 from handled __setup() functions Sasha Levin 2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 37/37] minix: fix bug when opening a file with O_DIRECT Sasha Levin
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220401144446.1954694-26-sashal@kernel.org \ --to=sashal@kernel.org \ --cc=ast@kernel.org \ --cc=baymaxhuang@gmail.com \ --cc=bpf@vger.kernel.org \ --cc=daniel@iogearbox.net \ --cc=davem@davemloft.net \ --cc=eric.dumazet@gmail.com \ --cc=hawk@kernel.org \ --cc=john.fastabend@gmail.com \ --cc=kuba@kernel.org \ --cc=kvm@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mst@redhat.com \ --cc=netdev@vger.kernel.org \ --cc=pabeni@redhat.com \ --cc=stable@vger.kernel.org \ --cc=virtualization@lists.linux-foundation.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.