From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86D65C0015E for ; Tue, 1 Aug 2023 14:20:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234593AbjHAOUC (ORCPT ); Tue, 1 Aug 2023 10:20:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234604AbjHAOT5 (ORCPT ); Tue, 1 Aug 2023 10:19:57 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F2EAEB1 for ; Tue, 1 Aug 2023 07:19:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1690899554; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=/RBCCNSNER9keBqZEiKvDtVniv9ZXTWzP9vzUW4dQY4=; b=ZPZhCnx2rT3vMSorzwtH3jM5CNkzpTVJZwC2UfTnTww0ZQhGurOj17b3zSYHqdGpLFuav1 jfvjS+NtYujQdfTasKJxj/Tv7sPoOFefErPxTyfwdUh7WsUh5h/9AKVon8xv1LnS68nwKU uJKlhtB1jJ23sXaCxkDOMMTSwLR8U14= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-212-BZiRKqMXM4WOCOIycKfd2Q-1; Tue, 01 Aug 2023 10:19:10 -0400 X-MC-Unique: BZiRKqMXM4WOCOIycKfd2Q-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 85C6010504B1; Tue, 1 Aug 2023 14:19:08 +0000 (UTC) Received: from warthog.procyon.org.uk (unknown [10.42.28.131]) by smtp.corp.redhat.com (Postfix) with ESMTP id D49884024F83; Tue, 1 Aug 2023 14:19:06 +0000 (UTC) Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <64c903b02b234_1b307829418@willemb.c.googlers.com.notmuch> References: <64c903b02b234_1b307829418@willemb.c.googlers.com.notmuch> <64c7acd57270c_169cd129420@willemb.c.googlers.com.notmuch> <64c6672f580e3_11d0042944e@willemb.c.googlers.com.notmuch> <20230718160737.52c68c73@kernel.org> <000000000000881d0606004541d1@google.com> <0000000000001416bb06004ebf53@google.com> <792238.1690667367@warthog.procyon.org.uk> <831028.1690791233@warthog.procyon.org.uk> <1401696.1690893633@warthog.procyon.org.uk> To: Willem de Bruijn Cc: dhowells@redhat.com, Jakub Kicinski , syzbot , bpf@vger.kernel.org, brauner@kernel.org, davem@davemloft.net, dsahern@kernel.org, edumazet@google.com, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, pabeni@redhat.com, syzkaller-bugs@googlegroups.com, viro@zeniv.linux.org.uk Subject: Re: Endless loop in udp with MSG_SPLICE_READ - Re: [syzbot] [fs?] INFO: task hung in pipe_release (4) MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <1409098.1690899546.1@warthog.procyon.org.uk> Content-Transfer-Encoding: quoted-printable Date: Tue, 01 Aug 2023 15:19:06 +0100 Message-ID: <1409099.1690899546@warthog.procyon.org.uk> X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org The attached seems to work. I still think copy isn't correctly calculated= in some circumstances - as I showed, several terms in the maths cancel out, including the length of the data. I'm also not entirely sure what 'paged' means in this function. Should it actually be set in the MSG_SPLICE_PAGES context? --- udp: Fix __ip_addend_data() diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c index 6e70839257f7..54675a4f2c9f 100644 --- a/net/ipv4/ip_output.c +++ b/net/ipv4/ip_output.c @@ -1157,7 +1157,7 @@ static int __ip_append_data(struct sock *sk, pskb_trim_unique(skb_prev, maxfraglen); } = - copy =3D datalen - transhdrlen - fraggap - pagedlen; + copy =3D max_t(int, datalen - transhdrlen - fraggap - pagedlen, 0); if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fragga= p, skb) < 0) { err =3D -EFAULT; kfree_skb(skb);