Commit 42b73059 authored by Al Viro's avatar Al Viro Committed by David S. Miller

udp: fix linear skb reception with PEEK_OFF

copy_linear_skb() is broken; both of its callers actually
expect 'len' to be the amount we are trying to copy,
not the offset of the end.
Fix it keeping the meanings of arguments in sync with what the
callers (both of them) expect.
Also restore a saner behavior on EFAULT (i.e. preserving
the iov_iter position in case of failure):

The commit fd851ba9 ("udp: harden copy_linear_skb()")
avoids the more destructive effect of the buggy
copy_linear_skb(), e.g. no more invalid memory access, but
said function still behaves incorrectly: when peeking with
offset it can fail with EINVAL instead of copying the
appropriate amount of memory.
Reported-by: default avatarSasha Levin <alexander.levin@verizon.com>
Fixes: b65ac446 ("udp: try to avoid 2 cache miss on dequeue")
Fixes: fd851ba9 ("udp: harden copy_linear_skb()")
Signed-off-by: default avatarAl Viro <viro@ZenIV.linux.org.uk>
Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
Tested-by: default avatarSasha Levin <alexander.levin@verizon.com>
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e5645f51
...@@ -366,14 +366,13 @@ static inline bool udp_skb_is_linear(struct sk_buff *skb) ...@@ -366,14 +366,13 @@ static inline bool udp_skb_is_linear(struct sk_buff *skb)
static inline int copy_linear_skb(struct sk_buff *skb, int len, int off, static inline int copy_linear_skb(struct sk_buff *skb, int len, int off,
struct iov_iter *to) struct iov_iter *to)
{ {
int n, copy = len - off; int n;
if (copy < 0) n = copy_to_iter(skb->data + off, len, to);
return -EINVAL; if (n == len)
n = copy_to_iter(skb->data + off, copy, to);
if (n == copy)
return 0; return 0;
iov_iter_revert(to, n);
return -EFAULT; return -EFAULT;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment