Davide Caratti e7579d5d5b net: mptcp: cap forward allocation to 1M ... the following syzkaller reproducer: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f6", 0xffffffe7, 0xc000, 0x0, 0x0) systematically triggers the following warning: WARNING: CPU: 2 PID: 8618 at net/core/stream.c:208 sk_stream_kill_queues+0x3fa/0x580 Modules linked in: CPU: 2 PID: 8618 Comm: syz-executor Not tainted 5.10.0+ #334 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/04 RIP: 0010:sk_stream_kill_queues+0x3fa/0x580 Code: df 48 c1 ea 03 0f b6 04 02 84 c0 74 04 3c 03 7e 40 8b ab 20 02 00 00 e9 64 ff ff ff e8 df f0 81 2 RSP: 0018:ffffc9000290fcb0 EFLAGS: 00010293 RAX: ffff888011cb8000 RBX: 0000000000000000 RCX: ffffffff86eecf0e RDX: 0000000000000000 RSI: ffffffff86eecf6a RDI: 0000000000000005 RBP: 0000000000000e28 R08: ffff888011cb8000 R09: fffffbfff1f48139 R10: ffffffff8fa409c7 R11: fffffbfff1f48138 R12: ffff8880215e6220 R13: ffffffff8fa409c0 R14: ffffc9000290fd30 R15: 1ffff92000521fa2 FS: 00007f41c78f4800(0000) GS:ffff88802d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f95c803d088 CR3: 0000000025ed2000 CR4: 00000000000006f0 Call Trace: __mptcp_destroy_sock+0x4f5/0x8e0 mptcp_close+0x5e2/0x7f0 inet_release+0x12b/0x270 __sock_release+0xc8/0x270 sock_close+0x18/0x20 __fput+0x272/0x8e0 task_work_run+0xe0/0x1a0 exit_to_user_mode_prepare+0x1df/0x200 syscall_exit_to_user_mode+0x19/0x50 entry_SYSCALL_64_after_hwframe+0x44/0xa9 userspace programs provide arbitrarily high values of 'len' in sendmsg(): this is causing integer overflow of 'amount'. Cap forward allocation to 1 megabyte: higher values are not really useful. Suggested-by: Paolo Abeni <pabeni@redhat.com> Fixes: e93da92896 ("mptcp: implement wmem reservation") Signed-off-by: Davide Caratti <dcaratti@redhat.com> Link: https://lore.kernel.org/r/3334d00d8b2faecafdfab9aa593efcbf61442756.1608584474.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2020-12-28 13:53:57 -08:00
..
crypto_test.c	mptcp: move crypto test to KUNIT	2020-06-26 16:21:39 -07:00
crypto.c	crypto: sha - split sha.h into sha1.h and sha2.h	2020-11-20 14:45:33 +11:00
ctrl.c	mptcp: add a new sysctl add_addr_timeout	2020-11-04 17:45:53 -08:00
diag.c	mptcp: allow dumping subflow context to userspace	2020-03-29 22:14:48 -07:00
Kconfig	mptcp: depends on IPV6 but not as a module	2020-10-21 08:05:40 -07:00
Makefile	mptcp: enable JOIN requests even if cookies are in use	2020-07-31 16:55:32 -07:00
mib.c	mptcp: print new line in mptcp_seq_show() if mptcp isn't in use	2020-12-07 17:45:29 -08:00
mib.h	mptcp: add RM_ADDR related mibs	2020-09-24 19:58:34 -07:00
mptcp_diag.c	mptcp: avoid a few atomic ops in the rx path	2020-11-30 17:55:23 -08:00
options.c	mptcp: push pending frames when subflow has free space	2020-12-17 10:24:47 -08:00
pm_netlink.c	mptcp: pm: simplify select_local_address()	2020-12-14 17:30:06 -08:00
pm.c	mptcp: link MPC subflow into msk only after accept	2020-12-09 19:31:58 -08:00
protocol.c	net: mptcp: cap forward allocation to 1M	2020-12-28 13:53:57 -08:00
protocol.h	mptcp: push pending frames when subflow has free space	2020-12-17 10:24:47 -08:00
subflow.c	Networking updates for 5.11	2020-12-15 13:22:29 -08:00
syncookies.c	mptcp: fix syncookie build error on UP	2020-08-01 11:52:55 -07:00
token_test.c	mptcp: introduce token KUNIT self-tests	2020-06-26 16:21:39 -07:00
token.c	mptcp: token: fix unititialized variable	2020-11-03 13:08:30 -08:00