• Florian Westphal's avatar
    mptcp: do not inherit inet proto ops · e42f1ac6
    Florian Westphal authored
    We need to initialise the struct ourselves, else we expose tcp-specific
    callbacks such as tcp_splice_read which will then trigger splat because
    the socket is an mptcp one:
    
    BUG: KASAN: slab-out-of-bounds in tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
    Write of size 8 at addr ffff888116aa21d0 by task syz-executor.0/5478
    
    CPU: 1 PID: 5478 Comm: syz-executor.0 Not tainted 5.5.0-rc6 #3
    Call Trace:
     tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
     tcp_rcv_space_adjust+0x72/0x7f0 net/ipv4/tcp_input.c:612
     tcp_read_sock+0x622/0x990 net/ipv4/tcp.c:1674
     tcp_splice_read+0x20b/0xb40 net/ipv4/tcp.c:791
     do_splice+0x1259/0x1560 fs/splice.c:1205
    
    To prevent build error with ipv6, add the recv/sendmsg function
    declaration to ipv6.h.  The functions are already accessible "thanks"
    to retpoline related work, but they are currently only made visible
    by socket.c specific INDIRECT_CALLABLE macros.
    Reported-by: default avatarChristoph Paasch <cpaasch@apple.com>
    Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
    Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e42f1ac6
protocol.c 30.1 KB