Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <1410156.1686729856@warthog.procyon.org.uk> <20230615222327.15e85c55@kernel.org>
In-Reply-To: <20230615222327.15e85c55@kernel.org>
From:   Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Date:   Fri, 16 Jun 2023 10:34:41 +0200
Message-ID: <CAF=yD-LLCoSTH1Jb+EFmpmTVO+Oo7Hjg6xcF4T2wR96QkjHZRw@mail.gmail.com>
Subject: Re: [PATCH net-next] ip, ip6: Fix splice to raw and ping sockets
To:     Jakub Kicinski <kuba@kernel.org>
Cc:     David Howells <dhowells@redhat.com>, netdev@vger.kernel.org,
        syzbot+d8486855ef44506fd675@syzkaller.appspotmail.com,
        David Ahern <dsahern@kernel.org>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Paolo Abeni <pabeni@redhat.com>, Jens Axboe <axboe@kernel.dk>,
        Matthew Wilcox <willy@infradead.org>,
        linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Fri, Jun 16, 2023 at 7:23=E2=80=AFAM Jakub Kicinski <kuba@kernel.org> wr=
ote:
>
> On Wed, 14 Jun 2023 09:04:16 +0100 David Howells wrote:
> > Splicing to SOCK_RAW sockets may set MSG_SPLICE_PAGES, but in such a ca=
se,
> > __ip_append_data() will call skb_splice_from_iter() to access the 'from=
'
> > data, assuming it to point to a msghdr struct with an iter, instead of
> > using the provided getfrag function to access it.
> >
> > In the case of raw_sendmsg(), however, this is not the case and 'from' =
will
> > point to a raw_frag_vec struct and raw_getfrag() will be the frag-getti=
ng
> > function.  A similar issue may occur with rawv6_sendmsg().
> >
> > Fix this by ignoring MSG_SPLICE_PAGES if getfrag !=3D ip_generic_getfra=
g as
> > ip_generic_getfrag() expects "from" to be a msghdr*, but the other getf=
rags
> > don't.  Note that this will prevent MSG_SPLICE_PAGES from being effecti=
ve
> > for udplite.
> >
> > This likely affects ping sockets too.  udplite looks like it should be =
okay
> > as it expects "from" to be a msghdr.
>
> Willem, looks good?

Reviewed-by: Willem de Bruijn <willemb@google.com>

Disabling splicing if not ip_generic_getfrag sounds great to me.