Patch "tipc: fix kernel WARNING in tipc_msg_append()" has been added to the 5.7-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tipc: fix kernel WARNING in tipc_msg_append()

to the 5.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tipc-fix-kernel-warning-in-tipc_msg_append.patch
and it can be found in the queue-5.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 188dba631a2392fe38321d576a8e5d0d098545bf
Author: Tuong Lien <tuong.t.lien@xxxxxxxxxxxxxx>
Date:   Thu Jun 11 17:07:35 2020 +0700

    tipc: fix kernel WARNING in tipc_msg_append()
    
    [ Upstream commit c9aa81faf19115fc2e732e7f210b37bb316987ff ]
    
    syzbot found the following issue:
    
    WARNING: CPU: 0 PID: 6808 at include/linux/thread_info.h:150 check_copy_size include/linux/thread_info.h:150 [inline]
    WARNING: CPU: 0 PID: 6808 at include/linux/thread_info.h:150 copy_from_iter include/linux/uio.h:144 [inline]
    WARNING: CPU: 0 PID: 6808 at include/linux/thread_info.h:150 tipc_msg_append+0x49a/0x5e0 net/tipc/msg.c:242
    Kernel panic - not syncing: panic_on_warn set ...
    
    This happens after commit 5e9eeccc58f3 ("tipc: fix NULL pointer
    dereference in streaming") that tried to build at least one buffer even
    when the message data length is zero... However, it now exposes another
    bug that the 'mss' can be zero and the 'cpy' will be negative, thus the
    above kernel WARNING will appear!
    The zero value of 'mss' is never expected because it means Nagle is not
    enabled for the socket (actually the socket type was 'SOCK_SEQPACKET'),
    so the function 'tipc_msg_append()' must not be called at all. But that
    was in this particular case since the message data length was zero, and
    the 'send <= maxnagle' check became true.
    
    We resolve the issue by explicitly checking if Nagle is enabled for the
    socket, i.e. 'maxnagle != 0' before calling the 'tipc_msg_append()'. We
    also reinforce the function to against such a negative values if any.
    
    Reported-by: syzbot+75139a7d2605236b0b7f@xxxxxxxxxxxxxxxxxxxxxxxxx
    Fixes: c0bceb97db9e ("tipc: add smart nagle feature")
    Acked-by: Jon Maloy <jmaloy@xxxxxxxxxx>
    Signed-off-by: Tuong Lien <tuong.t.lien@xxxxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 93966321f8929..560d7a4c0ffff 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -239,14 +239,14 @@ int tipc_msg_append(struct tipc_msg *_hdr, struct msghdr *m, int dlen,
 		hdr = buf_msg(skb);
 		curr = msg_blocks(hdr);
 		mlen = msg_size(hdr);
-		cpy = min_t(int, rem, mss - mlen);
+		cpy = min_t(size_t, rem, mss - mlen);
 		if (cpy != copy_from_iter(skb->data + mlen, cpy, &m->msg_iter))
 			return -EFAULT;
 		msg_set_size(hdr, mlen + cpy);
 		skb_put(skb, cpy);
 		rem -= cpy;
 		total += msg_blocks(hdr) - curr;
-	} while (rem);
+	} while (rem > 0);
 	return total - accounted;
 }
 
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index d6b67d07d22ec..62fc871a8d673 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1574,7 +1574,8 @@ static int __tipc_sendstream(struct socket *sock, struct msghdr *m, size_t dlen)
 			break;
 		send = min_t(size_t, dlen - sent, TIPC_MAX_USER_MSG_SIZE);
 		blocks = tsk->snd_backlog;
-		if (tsk->oneway++ >= tsk->nagle_start && send <= maxnagle) {
+		if (tsk->oneway++ >= tsk->nagle_start && maxnagle &&
+		    send <= maxnagle) {
 			rc = tipc_msg_append(hdr, m, send, maxnagle, txq);
 			if (unlikely(rc < 0))
 				break;