tcp: Sanitize CMSG flags and reserved args in tcp_zerocopy_receive.

Explicitly define reserved field and require it and any subsequent
fields to be zero-valued for now. Additionally, limit the valid CMSG
flags that tcp_zerocopy_receive accepts.

Fixes: 7eeba1706eba ("tcp: Add receive timestamp support for receive zerocopy.")
Signed-off-by: Arjun Roy <arjunroy@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Soheil Hassas Yeganeh <soheil@google.com>
Suggested-by: David Ahern <dsahern@gmail.com>
Suggested-by: Leon Romanovsky <leon@kernel.org>
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h
index 42fc5a6..8fc09e8 100644 (file)
--- a/include/uapi/linux/tcp.h
+++ b/include/uapi/linux/tcp.h
@@ -357,6 +357,6 @@ struct tcp_zerocopy_receive {
        __u64 msg_control; /* ancillary data */
        __u64 msg_controllen;
        __u32 msg_flags;
-       /* __u32 hole;  Next we must add >1 u32 otherwise length checks fail. */
+       __u32 reserved; /* set to 0 for now */
 };
 #endif /* _UAPI_LINUX_TCP_H */

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index e1a17c6..9896ca1 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2030,6 +2030,7 @@ static int tcp_zerocopy_vm_insert_batch(struct vm_area_struct *vma,
                err);
 }
 
+#define TCP_VALID_ZC_MSG_FLAGS   (TCP_CMSG_TS)
 static void tcp_recv_timestamp(struct msghdr *msg, const struct sock *sk,
                               struct scm_timestamping_internal *tss);
 static void tcp_zc_finalize_rx_tstamp(struct sock *sk,
@@ -4152,13 +4153,21 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                        return -EFAULT;
                if (len < offsetofend(struct tcp_zerocopy_receive, length))
                        return -EINVAL;
-               if (len > sizeof(zc)) {
+               if (unlikely(len > sizeof(zc))) {
+                       err = check_zeroed_user(optval + sizeof(zc),
+                                               len - sizeof(zc));
+                       if (err < 1)
+                               return err == 0 ? -EINVAL : err;
                        len = sizeof(zc);
                        if (put_user(len, optlen))
                                return -EFAULT;
                }
                if (copy_from_user(&zc, optval, len))
                        return -EFAULT;
+               if (zc.reserved)
+                       return -EINVAL;
+               if (zc.msg_flags &  ~(TCP_VALID_ZC_MSG_FLAGS))
+                       return -EINVAL;
                lock_sock(sk);
                err = tcp_zerocopy_receive(sk, &zc, &tss);
                release_sock(sk);