From: Greg Kroah-Hartman Date: Thu, 10 May 2018 14:03:27 +0000 (+0200) Subject: 3.18-stable patches X-Git-Tag: v3.18.109~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=828d1cb5dfeeabf56a2cceff5cfdc6d57e02aa70;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: net-fix-rtnh_ok.patch net-fix-uninit-value-in-__hw_addr_add_ex.patch net-initialize-skb-peeked-when-cloning.patch netlink-fix-uninit-value-in-netlink_sendmsg.patch perf-remove-superfluous-allocation-error-check.patch soreuseport-initialise-timewait-reuseport-field.patch tcp-fix-tcp_repair_queue-bound-checking.patch --- diff --git a/queue-3.18/net-fix-rtnh_ok.patch b/queue-3.18/net-fix-rtnh_ok.patch new file mode 100644 index 00000000000..7931c83aa8d --- /dev/null +++ b/queue-3.18/net-fix-rtnh_ok.patch @@ -0,0 +1,39 @@ +From b1993a2de12c9e75c35729e2ffbc3a92d50c0d31 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 7 Apr 2018 13:42:38 -0700 +Subject: net: fix rtnh_ok() + +From: Eric Dumazet + +commit b1993a2de12c9e75c35729e2ffbc3a92d50c0d31 upstream. + +syzbot reported : + +BUG: KMSAN: uninit-value in rtnh_ok include/net/nexthop.h:11 [inline] +BUG: KMSAN: uninit-value in fib_count_nexthops net/ipv4/fib_semantics.c:469 [inline] +BUG: KMSAN: uninit-value in fib_create_info+0x554/0x8d20 net/ipv4/fib_semantics.c:1091 + +@remaining is an integer, coming from user space. +If it is negative we want rtnh_ok() to return false. + +Fixes: 4e902c57417c ("[IPv4]: FIB configuration using struct fib_config") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/nexthop.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/net/nexthop.h ++++ b/include/net/nexthop.h +@@ -6,7 +6,7 @@ + + static inline int rtnh_ok(const struct rtnexthop *rtnh, int remaining) + { +- return remaining >= sizeof(*rtnh) && ++ return remaining >= (int)sizeof(*rtnh) && + rtnh->rtnh_len >= sizeof(*rtnh) && + rtnh->rtnh_len <= remaining; + } diff --git a/queue-3.18/net-fix-uninit-value-in-__hw_addr_add_ex.patch b/queue-3.18/net-fix-uninit-value-in-__hw_addr_add_ex.patch new file mode 100644 index 00000000000..ad3e1f3bc84 --- /dev/null +++ b/queue-3.18/net-fix-uninit-value-in-__hw_addr_add_ex.patch @@ -0,0 +1,56 @@ +From 77d36398d99f2565c0a8d43a86fd520a82e64bb8 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 7 Apr 2018 13:42:40 -0700 +Subject: net: fix uninit-value in __hw_addr_add_ex() + +From: Eric Dumazet + +commit 77d36398d99f2565c0a8d43a86fd520a82e64bb8 upstream. + +syzbot complained : + +BUG: KMSAN: uninit-value in memcmp+0x119/0x180 lib/string.c:861 +CPU: 0 PID: 3 Comm: kworker/0:0 Not tainted 4.16.0+ #82 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Workqueue: ipv6_addrconf addrconf_dad_work +Call Trace: + __dump_stack lib/dump_stack.c:17 [inline] + dump_stack+0x185/0x1d0 lib/dump_stack.c:53 + kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 + __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676 + memcmp+0x119/0x180 lib/string.c:861 + __hw_addr_add_ex net/core/dev_addr_lists.c:60 [inline] + __dev_mc_add+0x1c2/0x8e0 net/core/dev_addr_lists.c:670 + dev_mc_add+0x6d/0x80 net/core/dev_addr_lists.c:687 + igmp6_group_added+0x2db/0xa00 net/ipv6/mcast.c:662 + ipv6_dev_mc_inc+0xe9e/0x1130 net/ipv6/mcast.c:914 + addrconf_join_solict net/ipv6/addrconf.c:2078 [inline] + addrconf_dad_begin net/ipv6/addrconf.c:3828 [inline] + addrconf_dad_work+0x427/0x2150 net/ipv6/addrconf.c:3954 + process_one_work+0x12c6/0x1f60 kernel/workqueue.c:2113 + worker_thread+0x113c/0x24f0 kernel/workqueue.c:2247 + kthread+0x539/0x720 kernel/kthread.c:239 + +Fixes: f001fde5eadd ("net: introduce a list of device addresses dev_addr_list (v6)") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/dev_addr_lists.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/core/dev_addr_lists.c ++++ b/net/core/dev_addr_lists.c +@@ -57,8 +57,8 @@ static int __hw_addr_add_ex(struct netde + return -EINVAL; + + list_for_each_entry(ha, &list->list, list) { +- if (!memcmp(ha->addr, addr, addr_len) && +- ha->type == addr_type) { ++ if (ha->type == addr_type && ++ !memcmp(ha->addr, addr, addr_len)) { + if (global) { + /* check if addr is already used as global */ + if (ha->global_use) diff --git a/queue-3.18/net-initialize-skb-peeked-when-cloning.patch b/queue-3.18/net-initialize-skb-peeked-when-cloning.patch new file mode 100644 index 00000000000..7684ae77d9e --- /dev/null +++ b/queue-3.18/net-initialize-skb-peeked-when-cloning.patch @@ -0,0 +1,34 @@ +From b13dda9f9aa7caceeee61c080c2e544d5f5d85e5 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 7 Apr 2018 13:42:39 -0700 +Subject: net: initialize skb->peeked when cloning + +From: Eric Dumazet + +commit b13dda9f9aa7caceeee61c080c2e544d5f5d85e5 upstream. + +syzbot reported __skb_try_recv_from_queue() was using skb->peeked +while it was potentially unitialized. + +We need to clear it in __skb_clone() + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/skbuff.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -779,6 +779,7 @@ static struct sk_buff *__skb_clone(struc + n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len; + n->cloned = 1; + n->nohdr = 0; ++ n->peeked = 0; + n->destructor = NULL; + C(tail); + C(end); diff --git a/queue-3.18/netlink-fix-uninit-value-in-netlink_sendmsg.patch b/queue-3.18/netlink-fix-uninit-value-in-netlink_sendmsg.patch new file mode 100644 index 00000000000..d7126389484 --- /dev/null +++ b/queue-3.18/netlink-fix-uninit-value-in-netlink_sendmsg.patch @@ -0,0 +1,35 @@ +From 6091f09c2f79730d895149bcfe3d66140288cd0e Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 7 Apr 2018 13:42:37 -0700 +Subject: netlink: fix uninit-value in netlink_sendmsg + +From: Eric Dumazet + +commit 6091f09c2f79730d895149bcfe3d66140288cd0e upstream. + +syzbot reported : + +BUG: KMSAN: uninit-value in ffs arch/x86/include/asm/bitops.h:432 [inline] +BUG: KMSAN: uninit-value in netlink_sendmsg+0xb26/0x1310 net/netlink/af_netlink.c:1851 + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/netlink/af_netlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1641,6 +1641,8 @@ static int netlink_sendmsg(struct kiocb + + if (msg->msg_namelen) { + err = -EINVAL; ++ if (msg->msg_namelen < sizeof(struct sockaddr_nl)) ++ goto out; + if (addr->nl_family != AF_NETLINK) + goto out; + dst_portid = addr->nl_pid; diff --git a/queue-3.18/perf-remove-superfluous-allocation-error-check.patch b/queue-3.18/perf-remove-superfluous-allocation-error-check.patch new file mode 100644 index 00000000000..0956ddc7e07 --- /dev/null +++ b/queue-3.18/perf-remove-superfluous-allocation-error-check.patch @@ -0,0 +1,52 @@ +From bfb3d7b8b906b66551424d7636182126e1d134c8 Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Sun, 15 Apr 2018 11:23:52 +0200 +Subject: perf: Remove superfluous allocation error check + +From: Jiri Olsa + +commit bfb3d7b8b906b66551424d7636182126e1d134c8 upstream. + +If the get_callchain_buffers fails to allocate the buffer it will +decrease the nr_callchain_events right away. + +There's no point of checking the allocation error for +nr_callchain_events > 1. Removing that check. + +Signed-off-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: H. Peter Anvin +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: syzkaller-bugs@googlegroups.com +Cc: x86@kernel.org +Link: http://lkml.kernel.org/r/20180415092352.12403-3-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/events/callchain.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +--- a/kernel/events/callchain.c ++++ b/kernel/events/callchain.c +@@ -107,14 +107,8 @@ int get_callchain_buffers(void) + goto exit; + } + +- if (count > 1) { +- /* If the allocation failed, give up */ +- if (!callchain_cpus_entries) +- err = -ENOMEM; +- goto exit; +- } +- +- err = alloc_callchain_buffers(); ++ if (count == 1) ++ err = alloc_callchain_buffers(); + exit: + if (err) + atomic_dec(&nr_callchain_events); diff --git a/queue-3.18/series b/queue-3.18/series index ae24b37f0fc..18068320b95 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -9,3 +9,10 @@ rdma-mlx5-protect-from-shift-operand-overflow.patch net-usb-qmi_wwan-add-support-for-ublox-r410m-pid-0x90b2.patch usb-serial-visor-handle-potential-invalid-device-configuration.patch usb-musb-host-fix-potential-null-pointer-dereference.patch +netlink-fix-uninit-value-in-netlink_sendmsg.patch +net-fix-rtnh_ok.patch +net-initialize-skb-peeked-when-cloning.patch +net-fix-uninit-value-in-__hw_addr_add_ex.patch +soreuseport-initialise-timewait-reuseport-field.patch +perf-remove-superfluous-allocation-error-check.patch +tcp-fix-tcp_repair_queue-bound-checking.patch diff --git a/queue-3.18/soreuseport-initialise-timewait-reuseport-field.patch b/queue-3.18/soreuseport-initialise-timewait-reuseport-field.patch new file mode 100644 index 00000000000..1d0054a3a3b --- /dev/null +++ b/queue-3.18/soreuseport-initialise-timewait-reuseport-field.patch @@ -0,0 +1,149 @@ +From 3099a52918937ab86ec47038ad80d377ba16c531 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sat, 7 Apr 2018 13:42:43 -0700 +Subject: soreuseport: initialise timewait reuseport field + +From: Eric Dumazet + +commit 3099a52918937ab86ec47038ad80d377ba16c531 upstream. + +syzbot reported an uninit-value in inet_csk_bind_conflict() [1] + +It turns out we never propagated sk->sk_reuseport into timewait socket. + +[1] +BUG: KMSAN: uninit-value in inet_csk_bind_conflict+0x5f9/0x990 net/ipv4/inet_connection_sock.c:151 +CPU: 1 PID: 3589 Comm: syzkaller008242 Not tainted 4.16.0+ #82 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:17 [inline] + dump_stack+0x185/0x1d0 lib/dump_stack.c:53 + kmsan_report+0x142/0x240 mm/kmsan/kmsan.c:1067 + __msan_warning_32+0x6c/0xb0 mm/kmsan/kmsan_instr.c:676 + inet_csk_bind_conflict+0x5f9/0x990 net/ipv4/inet_connection_sock.c:151 + inet_csk_get_port+0x1d28/0x1e40 net/ipv4/inet_connection_sock.c:320 + inet6_bind+0x121c/0x1820 net/ipv6/af_inet6.c:399 + SYSC_bind+0x3f2/0x4b0 net/socket.c:1474 + SyS_bind+0x54/0x80 net/socket.c:1460 + do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 + entry_SYSCALL_64_after_hwframe+0x3d/0xa2 +RIP: 0033:0x4416e9 +RSP: 002b:00007ffce6d15c88 EFLAGS: 00000217 ORIG_RAX: 0000000000000031 +RAX: ffffffffffffffda RBX: 0100000000000000 RCX: 00000000004416e9 +RDX: 000000000000001c RSI: 0000000020402000 RDI: 0000000000000004 +RBP: 0000000000000000 R08: 00000000e6d15e08 R09: 00000000e6d15e08 +R10: 0000000000000004 R11: 0000000000000217 R12: 0000000000009478 +R13: 00000000006cd448 R14: 0000000000000000 R15: 0000000000000000 + +Uninit was stored to memory at: + kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] + kmsan_save_stack mm/kmsan/kmsan.c:293 [inline] + kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684 + __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521 + tcp_time_wait+0xf17/0xf50 net/ipv4/tcp_minisocks.c:283 + tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003 + tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331 + sk_backlog_rcv include/net/sock.h:908 [inline] + __release_sock+0x2d6/0x680 net/core/sock.c:2271 + release_sock+0x97/0x2a0 net/core/sock.c:2786 + tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269 + inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427 + inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435 + sock_release net/socket.c:595 [inline] + sock_close+0xe0/0x300 net/socket.c:1149 + __fput+0x49e/0xa10 fs/file_table.c:209 + ____fput+0x37/0x40 fs/file_table.c:243 + task_work_run+0x243/0x2c0 kernel/task_work.c:113 + exit_task_work include/linux/task_work.h:22 [inline] + do_exit+0x10e1/0x38d0 kernel/exit.c:867 + do_group_exit+0x1a0/0x360 kernel/exit.c:970 + SYSC_exit_group+0x21/0x30 kernel/exit.c:981 + SyS_exit_group+0x25/0x30 kernel/exit.c:979 + do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 + entry_SYSCALL_64_after_hwframe+0x3d/0xa2 +Uninit was stored to memory at: + kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] + kmsan_save_stack mm/kmsan/kmsan.c:293 [inline] + kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:684 + __msan_chain_origin+0x69/0xc0 mm/kmsan/kmsan_instr.c:521 + inet_twsk_alloc+0xaef/0xc00 net/ipv4/inet_timewait_sock.c:182 + tcp_time_wait+0xd9/0xf50 net/ipv4/tcp_minisocks.c:258 + tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003 + tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331 + sk_backlog_rcv include/net/sock.h:908 [inline] + __release_sock+0x2d6/0x680 net/core/sock.c:2271 + release_sock+0x97/0x2a0 net/core/sock.c:2786 + tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269 + inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427 + inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435 + sock_release net/socket.c:595 [inline] + sock_close+0xe0/0x300 net/socket.c:1149 + __fput+0x49e/0xa10 fs/file_table.c:209 + ____fput+0x37/0x40 fs/file_table.c:243 + task_work_run+0x243/0x2c0 kernel/task_work.c:113 + exit_task_work include/linux/task_work.h:22 [inline] + do_exit+0x10e1/0x38d0 kernel/exit.c:867 + do_group_exit+0x1a0/0x360 kernel/exit.c:970 + SYSC_exit_group+0x21/0x30 kernel/exit.c:981 + SyS_exit_group+0x25/0x30 kernel/exit.c:979 + do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 + entry_SYSCALL_64_after_hwframe+0x3d/0xa2 +Uninit was created at: + kmsan_save_stack_with_flags mm/kmsan/kmsan.c:278 [inline] + kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:188 + kmsan_kmalloc+0x94/0x100 mm/kmsan/kmsan.c:314 + kmem_cache_alloc+0xaab/0xb90 mm/slub.c:2756 + inet_twsk_alloc+0x13b/0xc00 net/ipv4/inet_timewait_sock.c:163 + tcp_time_wait+0xd9/0xf50 net/ipv4/tcp_minisocks.c:258 + tcp_rcv_state_process+0xebe/0x6490 net/ipv4/tcp_input.c:6003 + tcp_v6_do_rcv+0x11dd/0x1d90 net/ipv6/tcp_ipv6.c:1331 + sk_backlog_rcv include/net/sock.h:908 [inline] + __release_sock+0x2d6/0x680 net/core/sock.c:2271 + release_sock+0x97/0x2a0 net/core/sock.c:2786 + tcp_close+0x277/0x18f0 net/ipv4/tcp.c:2269 + inet_release+0x240/0x2a0 net/ipv4/af_inet.c:427 + inet6_release+0xaf/0x100 net/ipv6/af_inet6.c:435 + sock_release net/socket.c:595 [inline] + sock_close+0xe0/0x300 net/socket.c:1149 + __fput+0x49e/0xa10 fs/file_table.c:209 + ____fput+0x37/0x40 fs/file_table.c:243 + task_work_run+0x243/0x2c0 kernel/task_work.c:113 + exit_task_work include/linux/task_work.h:22 [inline] + do_exit+0x10e1/0x38d0 kernel/exit.c:867 + do_group_exit+0x1a0/0x360 kernel/exit.c:970 + SYSC_exit_group+0x21/0x30 kernel/exit.c:981 + SyS_exit_group+0x25/0x30 kernel/exit.c:979 + do_syscall_64+0x309/0x430 arch/x86/entry/common.c:287 + entry_SYSCALL_64_after_hwframe+0x3d/0xa2 + +Fixes: da5e36308d9f ("soreuseport: TCP/IPv4 implementation") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/inet_timewait_sock.h | 1 + + net/ipv4/inet_timewait_sock.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/include/net/inet_timewait_sock.h ++++ b/include/net/inet_timewait_sock.h +@@ -108,6 +108,7 @@ struct inet_timewait_sock { + #define tw_family __tw_common.skc_family + #define tw_state __tw_common.skc_state + #define tw_reuse __tw_common.skc_reuse ++#define tw_reuseport __tw_common.skc_reuseport + #define tw_ipv6only __tw_common.skc_ipv6only + #define tw_bound_dev_if __tw_common.skc_bound_dev_if + #define tw_node __tw_common.skc_nulls_node +--- a/net/ipv4/inet_timewait_sock.c ++++ b/net/ipv4/inet_timewait_sock.c +@@ -191,6 +191,7 @@ struct inet_timewait_sock *inet_twsk_all + tw->tw_dport = inet->inet_dport; + tw->tw_family = sk->sk_family; + tw->tw_reuse = sk->sk_reuse; ++ tw->tw_reuseport = sk->sk_reuseport; + tw->tw_hash = sk->sk_hash; + tw->tw_ipv6only = 0; + tw->tw_transparent = inet->transparent; diff --git a/queue-3.18/tcp-fix-tcp_repair_queue-bound-checking.patch b/queue-3.18/tcp-fix-tcp_repair_queue-bound-checking.patch new file mode 100644 index 00000000000..27413b17317 --- /dev/null +++ b/queue-3.18/tcp-fix-tcp_repair_queue-bound-checking.patch @@ -0,0 +1,50 @@ +From bf2acc943a45d2b2e8a9f1a5ddff6b6e43cc69d9 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Sun, 29 Apr 2018 18:55:20 -0700 +Subject: tcp: fix TCP_REPAIR_QUEUE bound checking + +From: Eric Dumazet + +commit bf2acc943a45d2b2e8a9f1a5ddff6b6e43cc69d9 upstream. + +syzbot is able to produce a nasty WARN_ON() in tcp_verify_left_out() +with following C-repro : + +socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 3 +setsockopt(3, SOL_TCP, TCP_REPAIR, [1], 4) = 0 +setsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [-1], 4) = 0 +bind(3, {sa_family=AF_INET, sin_port=htons(20002), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 +sendto(3, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., + 1242, MSG_FASTOPEN, {sa_family=AF_INET, sin_port=htons(20002), sin_addr=inet_addr("127.0.0.1")}, 16) = 1242 +setsockopt(3, SOL_TCP, TCP_REPAIR_WINDOW, "\4\0\0@+\205\0\0\377\377\0\0\377\377\377\177\0\0\0\0", 20) = 0 +writev(3, [{"\270", 1}], 1) = 1 +setsockopt(3, SOL_TCP, TCP_REPAIR_OPTIONS, "\10\0\0\0\0\0\0\0\0\0\0\0|\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 386) = 0 +writev(3, [{"\210v\r[\226\320t\231qwQ\204\264l\254\t\1\20\245\214p\350H\223\254;\\\37\345\307p$"..., 3144}], 1) = 3144 + +The 3rd system call looks odd : +setsockopt(3, SOL_TCP, TCP_REPAIR_QUEUE, [-1], 4) = 0 + +This patch makes sure bound checking is using an unsigned compare. + +Fixes: ee9952831cfd ("tcp: Initial repair mode") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Cc: Pavel Emelyanov +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2461,7 +2461,7 @@ static int do_tcp_setsockopt(struct sock + case TCP_REPAIR_QUEUE: + if (!tp->repair) + err = -EPERM; +- else if (val < TCP_QUEUES_NR) ++ else if ((unsigned int)val < TCP_QUEUES_NR) + tp->repair_queue = val; + else + err = -EINVAL;