* [PATCH v3 net 1/1] tipc: fix kernel warning when sending SYN message
@ 2023-02-14 1:26 Tung Nguyen
2023-02-15 4:50 ` patchwork-bot+netdevbpf
0 siblings, 1 reply; 2+ messages in thread
From: Tung Nguyen @ 2023-02-14 1:26 UTC (permalink / raw)
To: netdev
Cc: davem, kuba, edumazet, pabeni, jmaloy, ying.xue, viro,
syzbot+d43608d061e8847ec9f3
When sending a SYN message, this kernel stack trace is observed:
...
[ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550
...
[ 13.398494] Call Trace:
[ 13.398630] <TASK>
[ 13.398630] ? __alloc_skb+0xed/0x1a0
[ 13.398630] tipc_msg_build+0x12c/0x670 [tipc]
[ 13.398630] ? shmem_add_to_page_cache.isra.71+0x151/0x290
[ 13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc]
[ 13.398630] ? tipc_connect+0x1d9/0x230 [tipc]
[ 13.398630] ? __local_bh_enable_ip+0x37/0x80
[ 13.398630] tipc_connect+0x1d9/0x230 [tipc]
[ 13.398630] ? __sys_connect+0x9f/0xd0
[ 13.398630] __sys_connect+0x9f/0xd0
[ 13.398630] ? preempt_count_add+0x4d/0xa0
[ 13.398630] ? fpregs_assert_state_consistent+0x22/0x50
[ 13.398630] __x64_sys_connect+0x16/0x20
[ 13.398630] do_syscall_64+0x42/0x90
[ 13.398630] entry_SYSCALL_64_after_hwframe+0x63/0xcd
It is because commit a41dad905e5a ("iov_iter: saner checks for attempt
to copy to/from iterator") has introduced sanity check for copying
from/to iov iterator. Lacking of copy direction from the iterator
viewpoint would lead to kernel stack trace like above.
This commit fixes this issue by initializing the iov iterator with
the correct copy direction when sending SYN or ACK without data.
Fixes: f25dcc7687d4 ("tipc: tipc ->sendmsg() conversion")
Reported-by: syzbot+d43608d061e8847ec9f3@syzkaller.appspotmail.com
Acked-by: Jon Maloy <jmaloy@redhat.com>
Signed-off-by: Tung Nguyen <tung.q.nguyen@dektech.com.au>
---
v3: adapt to Paolo and Jakub's comments
net/tipc/socket.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index b35c8701876a..a38733f2197a 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -2614,6 +2614,7 @@ static int tipc_connect(struct socket *sock, struct sockaddr *dest,
/* Send a 'SYN-' to destination */
m.msg_name = dest;
m.msg_namelen = destlen;
+ iov_iter_kvec(&m.msg_iter, ITER_SOURCE, NULL, 0, 0);
/* If connect is in non-blocking case, set MSG_DONTWAIT to
* indicate send_msg() is never blocked.
@@ -2776,6 +2777,7 @@ static int tipc_accept(struct socket *sock, struct socket *new_sock, int flags,
__skb_queue_head(&new_sk->sk_receive_queue, buf);
skb_set_owner_r(buf, new_sk);
}
+ iov_iter_kvec(&m.msg_iter, ITER_SOURCE, NULL, 0, 0);
__tipc_sendstream(new_sock, &m, 0);
release_sock(new_sk);
exit:
--
2.34.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH v3 net 1/1] tipc: fix kernel warning when sending SYN message
2023-02-14 1:26 [PATCH v3 net 1/1] tipc: fix kernel warning when sending SYN message Tung Nguyen
@ 2023-02-15 4:50 ` patchwork-bot+netdevbpf
0 siblings, 0 replies; 2+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-02-15 4:50 UTC (permalink / raw)
To: Tung Nguyen
Cc: netdev, davem, kuba, edumazet, pabeni, jmaloy, ying.xue, viro,
syzbot+d43608d061e8847ec9f3
Hello:
This patch was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 14 Feb 2023 01:26:06 +0000 you wrote:
> When sending a SYN message, this kernel stack trace is observed:
>
> ...
> [ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550
> ...
> [ 13.398494] Call Trace:
> [ 13.398630] <TASK>
> [ 13.398630] ? __alloc_skb+0xed/0x1a0
> [ 13.398630] tipc_msg_build+0x12c/0x670 [tipc]
> [ 13.398630] ? shmem_add_to_page_cache.isra.71+0x151/0x290
> [ 13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc]
> [ 13.398630] ? tipc_connect+0x1d9/0x230 [tipc]
> [ 13.398630] ? __local_bh_enable_ip+0x37/0x80
> [ 13.398630] tipc_connect+0x1d9/0x230 [tipc]
> [ 13.398630] ? __sys_connect+0x9f/0xd0
> [ 13.398630] __sys_connect+0x9f/0xd0
> [ 13.398630] ? preempt_count_add+0x4d/0xa0
> [ 13.398630] ? fpregs_assert_state_consistent+0x22/0x50
> [ 13.398630] __x64_sys_connect+0x16/0x20
> [ 13.398630] do_syscall_64+0x42/0x90
> [ 13.398630] entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> [...]
Here is the summary with links:
- [v3,net,1/1] tipc: fix kernel warning when sending SYN message
https://git.kernel.org/netdev/net/c/11a4d6f67cf5
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-02-15 4:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-02-14 1:26 [PATCH v3 net 1/1] tipc: fix kernel warning when sending SYN message Tung Nguyen
2023-02-15 4:50 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.