Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley
        Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United
        Kingdom.
        Registered in England and Wales under Company Registration No. 3798903
From:   David Howells <dhowells@redhat.com>
In-Reply-To: <64c93109c084e_1c5e3529452@willemb.c.googlers.com.notmuch>
References: <64c93109c084e_1c5e3529452@willemb.c.googlers.com.notmuch> <1420063.1690904933@warthog.procyon.org.uk>
To:     Willem de Bruijn <willemdebruijn.kernel@gmail.com>
Cc:     dhowells@redhat.com, netdev@vger.kernel.org,
        syzbot+f527b971b4bdc8e79f9e@syzkaller.appspotmail.com,
        bpf@vger.kernel.org, brauner@kernel.org, davem@davemloft.net,
        dsahern@kernel.org, edumazet@google.com, kuba@kernel.org,
        pabeni@redhat.com, axboe@kernel.dk, viro@zeniv.linux.org.uk,
        linux-fsdevel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH net] udp: Fix __ip_append_data()'s handling of MSG_SPLICE_PAGES
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1481563.1690909060.1@warthog.procyon.org.uk>
Date:   Tue, 01 Aug 2023 17:57:40 +0100
Message-ID: <1481564.1690909060@warthog.procyon.org.uk>
Precedence: bulk

Willem de Bruijn <willemdebruijn.kernel@gmail.com> wrote:

> copy -= -fraggap definitely seems off. You point out that it even can
> turn length negative?

Yes.  See the logging I posted:

	==>splice_to_socket() 6630
	udp_sendmsg(8,8)
	__ip_append_data(copy=-1,len=8, mtu=8192 skblen=8189 maxfl=8188)
	pagedlen 9 = 9 - 0
	copy -1 = 9 - 0 - 1 - 9
	length 8 -= -1 + 0

Since datalen and transhdrlen cancel, and fraggap is unsigned, if fraggap is
non-zero, copy will be negative.

> The WARN_ON_ONCE, if it can be reached, will be user triggerable.
> Usually for those cases and when there is a viable return with error
> path, that is preferable. But if you prefer to taunt syzbot, ok. We
> can always remove this later.

It shouldn't be possible for length to exceed msg->msg_iter.count (assuming
there is a msg) coming from userspace; further, userspace can't directly
specify MSG_SPLICE_PAGES.

> __ip6_append_data probably needs the same.

Good point.  The arrangement of the code is a bit different, but I think it's
substantially the same in this regard.

David