]> git.baikalelectronics.ru Git - kernel.git/commit
mptcp: do not inherit inet proto ops
authorFlorian Westphal <fw@strlen.de>
Sat, 25 Jan 2020 00:04:02 +0000 (16:04 -0800)
committerDavid S. Miller <davem@davemloft.net>
Sat, 25 Jan 2020 07:14:39 +0000 (08:14 +0100)
commite758b89eaf73148b586ad2ac41d7f0b81f1db975
tree0cba402eedefff40444f145c5209ee62e6008560
parent9ebeb3f6c622c74bcd60f327ad684fa4e10db959
mptcp: do not inherit inet proto ops

We need to initialise the struct ourselves, else we expose tcp-specific
callbacks such as tcp_splice_read which will then trigger splat because
the socket is an mptcp one:

BUG: KASAN: slab-out-of-bounds in tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
Write of size 8 at addr ffff888116aa21d0 by task syz-executor.0/5478

CPU: 1 PID: 5478 Comm: syz-executor.0 Not tainted 5.5.0-rc6 #3
Call Trace:
 tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
 tcp_rcv_space_adjust+0x72/0x7f0 net/ipv4/tcp_input.c:612
 tcp_read_sock+0x622/0x990 net/ipv4/tcp.c:1674
 tcp_splice_read+0x20b/0xb40 net/ipv4/tcp.c:791
 do_splice+0x1259/0x1560 fs/splice.c:1205

To prevent build error with ipv6, add the recv/sendmsg function
declaration to ipv6.h.  The functions are already accessible "thanks"
to retpoline related work, but they are currently only made visible
by socket.c specific INDIRECT_CALLABLE macros.

Reported-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/net/ipv6.h
net/mptcp/protocol.c