Commit 79a5b972 authored Feb 22, 2018 by Sowmini Varadhan Committed by David S. Miller Feb 23, 2018

rds: rds_msg_zcopy should return error of null rm->data.op_mmp_znotifier



if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been
specified, the rm->data.op_mmp_znotifier allocation will be skipped.
In this case, it is invalid ot pass down a cmsghdr with
RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this
case.

Reported-by:  <syzbot+f893ae7bb2f6456dfbc3@syzkaller.appspotmail.com>
Fixes: 0cebacce ("rds: zerocopy Tx support.")
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 9dbe7896

net/rds/send.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -941,7 +941,8 @@ static int rds_cmsg_zcopy(struct rds_sock rs, struct rds_message rm,
		{
		u32 *cookie;

		if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie)))
		if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie)) \|\|
		!rm->data.op_mmp_znotifier)
		return -EINVAL;
		cookie = CMSG_DATA(cmsg);
		rm->data.op_mmp_znotifier->z_cookie = *cookie;

Admin message