lkml.org 
[lkml]   [2022]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [syzbot] WARNING in _copy_from_iter
On Thu, Dec 08, 2022 at 08:38:14PM +0100, Eric Dumazet wrote:

> Exposes an old bug in tipc ?
>
> Seems a new check added by Al in :
>
> Author: Al Viro <viro@zeniv.linux.org.uk>
> Date: Thu Sep 15 20:11:15 2022 -0400
>
> iov_iter: saner checks for attempt to copy to/from iterator
>
> instead of "don't do it to ITER_PIPE" check for ->data_source being
> false on copying from iterator. Check for !->data_source for
> copying to iterator, while we are at it.
>
> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Lovely... zero-length sendmsg with uninitialized ->msg_data...

I would probably argue that it's a bug in tipc_connect(),
fixed by iov_iter_kvec(&m.msg_iter, ITER_SOURCE, NULL, 0, 0);
in there. Depends - if that kind of uninitialized msg_iter used
as zero length source or zero length destination is a frequent pattern,
might as well make zero-byte copy_...iter() succeed quietly;
I hope it isn't, but that's definitely something I'd missed
when doing that series.

I'll take a look tomorrow^Win the morning, after I get
some sleep...

\
 
 \ /
  Last update: 2022-12-11 10:39    [W:0.063 / U:0.196 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site