Re: [PATCH net-next] rds: rds_msg_zcopy should return error of null rm->data.op_mmp_znotifier

[David Miller]

From: Sowmini Varadhan 
Date: Thu, 22 Feb 2018 13:40:27 -0800

> if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been
> specified, the rm->data.op_mmp_znotifier allocation will be skipped.
> In this case, it is invalid ot pass down a cmsghdr with
> RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this
> case.
> 
> Reported-by: syzbot+f893ae7bb2f6456df...@syzkaller.appspotmail.com
> Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.")
> Signed-off-by: Sowmini Varadhan 

Applied, thank you.

Re: [PATCH net-next] rds: rds_msg_zcopy should return error of null rm->data.op_mmp_znotifier

[Santosh Shilimkar]

On 2/22/2018 1:40 PM, Sowmini Varadhan wrote:

if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been
specified, the rm->data.op_mmp_znotifier allocation will be skipped.
In this case, it is invalid ot pass down a cmsghdr with
RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this
case.

Reported-by: syzbot+f893ae7bb2f6456df...@syzkaller.appspotmail.com
Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.")
Signed-off-by: Sowmini Varadhan 
---


Acked-by: Santosh Shilimkar 

Re: [PATCH net-next] rds: rds_msg_zcopy should return error of null rm->data.op_mmp_znotifier

[Willem de Bruijn]

On Thu, Feb 22, 2018 at 4:40 PM, Sowmini Varadhan
 wrote:
> if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been
> specified, the rm->data.op_mmp_znotifier allocation will be skipped.
> In this case, it is invalid ot pass down a cmsghdr with
> RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this
> case.
>
> Reported-by: syzbot+f893ae7bb2f6456df...@syzkaller.appspotmail.com
> Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.")
> Signed-off-by: Sowmini Varadhan 

Acked-by: Willem de Bruijn 

[PATCH net-next] rds: rds_msg_zcopy should return error of null rm->data.op_mmp_znotifier

[Sowmini Varadhan]

if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been
specified, the rm->data.op_mmp_znotifier allocation will be skipped.
In this case, it is invalid ot pass down a cmsghdr with
RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this
case.

Reported-by: syzbot+f893ae7bb2f6456df...@syzkaller.appspotmail.com
Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.")
Signed-off-by: Sowmini Varadhan 
---
 net/rds/send.c |3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/net/rds/send.c b/net/rds/send.c
index 028ab59..c848cbb 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -939,7 +939,8 @@ static int rds_cmsg_zcopy(struct rds_sock *rs, struct 
rds_message *rm,
 {
u32 *cookie;
 
-   if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie)))
+   if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie)) ||
+   !rm->data.op_mmp_znotifier)
return -EINVAL;
cookie = CMSG_DATA(cmsg);
rm->data.op_mmp_znotifier->z_cookie = *cookie;
-- 
1.7.1