Patch "tcp: devmem: don't write truncated dmabuf CMSGs to userspace" has been added to the 6.13-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tcp: devmem: don't write truncated dmabuf CMSGs to userspace

to the 6.13-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tcp-devmem-don-t-write-truncated-dmabuf-cmsgs-to-use.patch
and it can be found in the queue-6.13 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1e3d288ec2da8a2996e10b347ada6523d0bfd4af
Author: Stanislav Fomichev <sdf@xxxxxxxxxxx>
Date:   Mon Feb 24 09:44:01 2025 -0800

    tcp: devmem: don't write truncated dmabuf CMSGs to userspace
    
    [ Upstream commit 18912c520674ec4d920fe3826e7e4fefeecdf5ae ]
    
    Currently, we report -ETOOSMALL (err) only on the first iteration
    (!sent). When we get put_cmsg error after a bunch of successful
    put_cmsg calls, we don't signal the error at all. This might be
    confusing on the userspace side which will see truncated CMSGs
    but no MSG_CTRUNC signal.
    
    Consider the following case:
    - sizeof(struct cmsghdr) = 16
    - sizeof(struct dmabuf_cmsg) = 24
    - total cmsg size (CMSG_LEN) = 40 (16+24)
    
    When calling recvmsg with msg_controllen=60, the userspace
    will receive two(!) dmabuf_cmsg(s), the first one will
    be a valid one and the second one will be silently truncated. There is no
    easy way to discover the truncation besides doing something like
    "cm->cmsg_len != CMSG_LEN(sizeof(dmabuf_cmsg))".
    
    Introduce new put_devmem_cmsg wrapper that reports an error instead
    of doing the truncation. Mina suggests that it's the intended way
    this API should work.
    
    Note that we might now report MSG_CTRUNC when the users (incorrectly)
    call us with msg_control == NULL.
    
    Fixes: 8f0b3cc9a4c1 ("tcp: RX path for devmem TCP")
    Reviewed-by: Mina Almasry <almasrymina@xxxxxxxxxx>
    Signed-off-by: Stanislav Fomichev <sdf@xxxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Link: https://patch.msgid.link/20250224174401.3582695-1-sdf@xxxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/linux/socket.h b/include/linux/socket.h
index d18cc47e89bd0..c3322eb3d6865 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -392,6 +392,8 @@ struct ucred {
 
 extern int move_addr_to_kernel(void __user *uaddr, int ulen, struct sockaddr_storage *kaddr);
 extern int put_cmsg(struct msghdr*, int level, int type, int len, void *data);
+extern int put_cmsg_notrunc(struct msghdr *msg, int level, int type, int len,
+			    void *data);
 
 struct timespec64;
 struct __kernel_timespec;
diff --git a/net/core/scm.c b/net/core/scm.c
index 4f6a14babe5ae..733c0cbd393d2 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -282,6 +282,16 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
 }
 EXPORT_SYMBOL(put_cmsg);
 
+int put_cmsg_notrunc(struct msghdr *msg, int level, int type, int len,
+		     void *data)
+{
+	/* Don't produce truncated CMSGs */
+	if (!msg->msg_control || msg->msg_controllen < CMSG_LEN(len))
+		return -ETOOSMALL;
+
+	return put_cmsg(msg, level, type, len, data);
+}
+
 void put_cmsg_scm_timestamping64(struct msghdr *msg, struct scm_timestamping_internal *tss_internal)
 {
 	struct scm_timestamping64 tss;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0d704bda6c416..d74281eca14f0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2438,14 +2438,12 @@ static int tcp_recvmsg_dmabuf(struct sock *sk, const struct sk_buff *skb,
 			 */
 			memset(&dmabuf_cmsg, 0, sizeof(dmabuf_cmsg));
 			dmabuf_cmsg.frag_size = copy;
-			err = put_cmsg(msg, SOL_SOCKET, SO_DEVMEM_LINEAR,
-				       sizeof(dmabuf_cmsg), &dmabuf_cmsg);
-			if (err || msg->msg_flags & MSG_CTRUNC) {
-				msg->msg_flags &= ~MSG_CTRUNC;
-				if (!err)
-					err = -ETOOSMALL;
+			err = put_cmsg_notrunc(msg, SOL_SOCKET,
+					       SO_DEVMEM_LINEAR,
+					       sizeof(dmabuf_cmsg),
+					       &dmabuf_cmsg);
+			if (err)
 				goto out;
-			}
 
 			sent += copy;
 
@@ -2499,16 +2497,12 @@ static int tcp_recvmsg_dmabuf(struct sock *sk, const struct sk_buff *skb,
 				offset += copy;
 				remaining_len -= copy;
 
-				err = put_cmsg(msg, SOL_SOCKET,
-					       SO_DEVMEM_DMABUF,
-					       sizeof(dmabuf_cmsg),
-					       &dmabuf_cmsg);
-				if (err || msg->msg_flags & MSG_CTRUNC) {
-					msg->msg_flags &= ~MSG_CTRUNC;
-					if (!err)
-						err = -ETOOSMALL;
+				err = put_cmsg_notrunc(msg, SOL_SOCKET,
+						       SO_DEVMEM_DMABUF,
+						       sizeof(dmabuf_cmsg),
+						       &dmabuf_cmsg);
+				if (err)
 					goto out;
-				}
 
 				atomic_long_inc(&niov->pp_ref_count);
 				tcp_xa_pool.netmems[tcp_xa_pool.idx++] = skb_frag_netmem(frag);