Kernel sources for Moto G9 (Play) (Guamp)
Find a file
David Howells 559d697c5d ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
[ Upstream commit 9d4c75800f61e5d75c1659ba201b6c0c7ead3070 ]

Including the transhdrlen in length is a problem when the packet is
partially filled (e.g. something like send(MSG_MORE) happened previously)
when appending to an IPv4 or IPv6 packet as we don't want to repeat the
transport header or account for it twice.  This can happen under some
circumstances, such as splicing into an L2TP socket.

The symptom observed is a warning in __ip6_append_data():

    WARNING: CPU: 1 PID: 5042 at net/ipv6/ip6_output.c:1800 __ip6_append_data.isra.0+0x1be8/0x47f0 net/ipv6/ip6_output.c:1800

that occurs when MSG_SPLICE_PAGES is used to append more data to an already
partially occupied skbuff.  The warning occurs when 'copy' is larger than
the amount of data in the message iterator.  This is because the requested
length includes the transport header length when it shouldn't.  This can be
triggered by, for example:

        sfd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_L2TP);
        bind(sfd, ...); // ::1
        connect(sfd, ...); // ::1 port 7
        send(sfd, buffer, 4100, MSG_MORE);
        sendfile(sfd, dfd, NULL, 1024);

Fix this by only adding transhdrlen into the length if the write queue is
empty in l2tp_ip6_sendmsg(), analogously to how UDP does things.

l2tp_ip_sendmsg() looks like it won't suffer from this problem as it builds
the UDP packet itself.

Fixes: a32e0eec70 ("l2tp: introduce L2TPv3 IP encapsulation support for IPv6")
Reported-by: syzbot+62cbf263225ae13ff153@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/0000000000001c12b30605378ce8@google.com/
Suggested-by: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Eric Dumazet <edumazet@google.com>
cc: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: David Ahern <dsahern@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: netdev@vger.kernel.org
cc: bpf@vger.kernel.org
cc: syzkaller-bugs@googlegroups.com
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-10-10 21:45:01 +02:00
arch parisc: irq: Make irq_stack_union static to avoid sparse warning 2023-10-10 21:44:58 +02:00
block block: fix signed int overflow in Amiga partition support 2023-08-30 16:31:46 +02:00
certs certs/blacklist_hashes.c: fix const confusion in certs blacklist 2022-06-25 11:49:16 +02:00
crypto X.509: if signature is unsupported skip validation 2023-09-23 10:48:11 +02:00
Documentation Documentation: security-bugs.rst: clarify CVE handling 2023-08-11 11:45:34 +02:00
drivers scsi: target: core: Fix deadlock due to recursive locking 2023-10-10 21:45:01 +02:00
firmware
fs ext4: fix rec_len verify error 2023-10-10 21:45:00 +02:00
include ata: libata: disallow dev-initiated LPM transitions to unsupported states 2023-10-10 21:45:00 +02:00
init init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() 2023-08-08 19:49:18 +02:00
ipc ipc/sem: Fix dangling sem_array access in semtimedop race 2022-12-08 11:18:35 +01:00
kernel ring-buffer: Avoid softlockup in ring_buffer_resize() 2023-10-10 21:44:58 +02:00
lib kobject: Add sanity check for kset->kobj.ktype in kset_register() 2023-09-23 10:48:17 +02:00
LICENSES
mm treewide: Remove uninitialized_var() usage 2023-08-11 11:45:01 +02:00
net ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() 2023-10-10 21:45:01 +02:00
samples samples/bpf: Fix buffer overflow in tcp_basertt 2023-08-11 11:45:03 +02:00
scripts modpost: add missing else to the "of" check 2023-10-10 21:45:01 +02:00
security smack: Record transmuting in smk_transmuted 2023-10-10 21:44:59 +02:00
sound ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q 2023-10-10 21:44:59 +02:00
tools bpf: Clarify error expectations from bpf_clone_redirect 2023-10-10 21:44:58 +02:00
usr
virt KVM: arm64: vgic: Fix exit condition in scan_its_table() 2022-11-03 23:52:24 +09:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS clocksource/drivers: Unify the names to timer-* format 2023-08-11 11:45:02 +02:00
Makefile Linux 4.19.295 2023-09-23 10:48:18 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.