Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

rds: rds_msg_zcopy should return error of null rm->data.op_mmp_znotifier

if either or both of MSG_ZEROCOPY and SOCK_ZEROCOPY have not been
specified, the rm->data.op_mmp_znotifier allocation will be skipped.
In this case, it is invalid ot pass down a cmsghdr with
RDS_CMSG_ZCOPY_COOKIE, so return EINVAL from rds_msg_zcopy for this
case.

Reported-by: syzbot+f893ae7bb2f6456dfbc3@syzkaller.appspotmail.com
Fixes: 0cebaccef3ac ("rds: zerocopy Tx support.")
Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Sowmini Varadhan and committed by
David S. Miller
79a5b972 9dbe7896

+2 -1
+2 -1
net/rds/send.c
··· 941 941 { 942 942 u32 *cookie; 943 943 944 - if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie))) 944 + if (cmsg->cmsg_len < CMSG_LEN(sizeof(*cookie)) || 945 + !rm->data.op_mmp_znotifier) 945 946 return -EINVAL; 946 947 cookie = CMSG_DATA(cmsg); 947 948 rm->data.op_mmp_znotifier->z_cookie = *cookie;