Commit 3c5a2fd0 authored by Arjun Roy's avatar Arjun Roy Committed by David S. Miller
Browse files

tcp: Sanitize CMSG flags and reserved args in tcp_zerocopy_receive. 



Explicitly define reserved field and require it and any subsequent
fields to be zero-valued for now. Additionally, limit the valid CMSG
flags that tcp_zerocopy_receive accepts.

Fixes: 7eeba170 ("tcp: Add receive timestamp support for receive zerocopy.")
Signed-off-by: default avatarArjun Roy <arjunroy@google.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarSoheil Hassas Yeganeh <soheil@google.com>
Suggested-by: default avatarDavid Ahern <dsahern@gmail.com>
Suggested-by: default avatarLeon Romanovsky <leon@kernel.org>
Suggested-by: default avatarJakub Kicinski <kuba@kernel.org>
Acked-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9fbb4a7a

include/uapi/linux/tcp.h

+1 −1
Original line number Diff line number Diff line
@@ -357,6 +357,6 @@ struct tcp_zerocopy_receive { 
	__u64 msg_control; /* ancillary data */

	__u64 msg_controllen;

	__u32 msg_flags;

	/* __u32 hole;  Next we must add >1 u32 otherwise length checks fail. */

	__u32 reserved; /* set to 0 for now */

};

#endif /* _UAPI_LINUX_TCP_H */

net/ipv4/tcp.c

+10 −1
Original line number Diff line number Diff line
@@ -2030,6 +2030,7 @@ static int tcp_zerocopy_vm_insert_batch(struct vm_area_struct *vma, 
		err);

}



#define TCP_VALID_ZC_MSG_FLAGS   (TCP_CMSG_TS)

static void tcp_recv_timestamp(struct msghdr *msg, const struct sock *sk,

			       struct scm_timestamping_internal *tss);

static void tcp_zc_finalize_rx_tstamp(struct sock *sk,
@@ -4152,13 +4153,21 @@ static int do_tcp_getsockopt(struct sock *sk, int level, 
			return -EFAULT;

		if (len < offsetofend(struct tcp_zerocopy_receive, length))

			return -EINVAL;

		if (len > sizeof(zc)) {

		if (unlikely(len > sizeof(zc))) {

			err = check_zeroed_user(optval + sizeof(zc),

						len - sizeof(zc));

			if (err < 1)

				return err == 0 ? -EINVAL : err;

			len = sizeof(zc);

			if (put_user(len, optlen))

				return -EFAULT;

		}

		if (copy_from_user(&zc, optval, len))

			return -EFAULT;

		if (zc.reserved)

			return -EINVAL;

		if (zc.msg_flags &  ~(TCP_VALID_ZC_MSG_FLAGS))

			return -EINVAL;

		lock_sock(sk);

		err = tcp_zerocopy_receive(sk, &zc, &tss);

		release_sock(sk);