Commit ce8064b9 authored by Eric Dumazet's avatar Eric Dumazet Committed by Ziyang Xuan
Browse files

tcp: add sanity checks to rx zerocopy 

stable inclusion
from stable-v5.10.210
commit f48bf9a83b1666d934247cb58a9887d7b3127b6f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I99JO6
CVE: CVE-2024-26640

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f48bf9a83b1666d934247cb58a9887d7b3127b6f

--------------------------------

[ Upstream commit 577e4432f3ac810049cb7e6b71f4d96ec7c6e894 ]

TCP rx zerocopy intent is to map pages initially allocated
from NIC drivers, not pages owned by a fs.

This patch adds to can_map_frag() these additional checks:

- Page must not be a compound one.
- page->mapping must be NULL.

This fixes the panic reported by ZhangPeng.

syzbot was able to loopback packets built with sendfile(),
mapping pages owned by an ext4 file to TCP rx zerocopy.

r3 = socket$inet_tcp(0x2, 0x1, 0x0)
mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e24, @multicast1}, 0x10)
connect$inet(r4, &(0x7f00000006c0)={0x2, 0x4e24, @empty}, 0x10)
r5 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00',
    0x181e42, 0x0)
fallocate(r5, 0x0, 0x0, 0x85b8)
sendfile(r4, r5, 0x0, 0x8ba0)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r4, 0x6, 0x23,
    &(0x7f00000001c0)={&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0,
    0x0, 0x0, 0x0, 0x0}, &(0x7f0000000440)=0x40)
r6 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00',
    0x181e42, 0x0)

Fixes: 93ab6cc6 ("tcp: implement mmap() for zero copy receive")
Link: https://lore.kernel.org/netdev/5106a58e-04da-372a-b836-9d3d0bd2507b@huawei.com/T/


Reported-and-bisected-by: default avatarZhangPeng <zhangpeng362@huawei.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Arjun Roy <arjunroy@google.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: linux-mm@vger.kernel.org
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
parent e83807ba

net/ipv4/tcp.c

+11 −1
Original line number Diff line number Diff line
@@ -1794,7 +1794,17 @@ static skb_frag_t *skb_advance_to_frag(struct sk_buff *skb, u32 offset_skb, 


static bool can_map_frag(const skb_frag_t *frag)

{

	return skb_frag_size(frag) == PAGE_SIZE && !skb_frag_off(frag);

	struct page *page;



	if (skb_frag_size(frag) != PAGE_SIZE || skb_frag_off(frag))

		return false;



	page = skb_frag_page(frag);



	if (PageCompound(page) || page->mapping)

		return false;



	return true;

}



static int find_next_mappable_frag(const skb_frag_t *frag,