The tcp_zerocopy_receive struct is used to create a shared memory region between userspace and the kernel in which received network packets are directly copied from the network interface card.
In PCuABI, a user pointer is a 129 bit capability, the __u64 type is not sufficient enough to store it. Instead __kernel_uinptr_t is used instead which is sufficient enough to store a capability whilst remaining 64-bits on other architectures.
Additional checks have been added to ensure that the owning capability has read access in order to read the received network packets from the shared memory region.
v2: - Remove uaddr_to_user_ptr usage to enforce capability model.
Signed-off-by: Harry Ramsey harry.ramsey@arm.com --- include/uapi/linux/tcp.h | 6 +++--- net/ipv4/tcp.c | 31 ++++++++++++++++++++----------- 2 files changed, 23 insertions(+), 14 deletions(-)
diff --git a/include/uapi/linux/tcp.h b/include/uapi/linux/tcp.h index 879eeb0a084b..972db73fd3cf 100644 --- a/include/uapi/linux/tcp.h +++ b/include/uapi/linux/tcp.h @@ -352,15 +352,15 @@ struct tcp_diag_md5sig {
#define TCP_RECEIVE_ZEROCOPY_FLAG_TLB_CLEAN_HINT 0x1 struct tcp_zerocopy_receive { - __u64 address; /* in: address of mapping */ + __kernel_uintptr_t address; /* in: address of mapping */ __u32 length; /* in/out: number of bytes to map/mapped */ __u32 recv_skip_hint; /* out: amount of bytes to skip */ __u32 inq; /* out: amount of bytes in read queue */ __s32 err; /* out: socket error */ - __u64 copybuf_address; /* in: copybuf address (small reads) */ + __kernel_uintptr_t copybuf_address; /* in: copybuf address (small reads) */ __s32 copybuf_len; /* in/out: copybuf bytes avail/used or error */ __u32 flags; /* in: flags */ - __u64 msg_control; /* ancillary data */ + __kernel_uintptr_t msg_control; /* ancillary data */ __u64 msg_controllen; __u32 msg_flags; __u32 reserved; /* set to 0 for now */ diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 96b3dbd7bb4e..383e74eacf4f 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2076,7 +2076,7 @@ static int receive_fallback_to_copy(struct sock *sk, struct tcp_zerocopy_receive *zc, int inq, struct scm_timestamping_internal *tss) { - unsigned long copy_address = (unsigned long)zc->copybuf_address; + __kernel_uintptr_t copy_address = zc->copybuf_address; struct msghdr msg = {}; struct iovec iov; int err; @@ -2087,7 +2087,10 @@ static int receive_fallback_to_copy(struct sock *sk, if (copy_address != zc->copybuf_address) return -EINVAL;
- err = import_single_range(ITER_DEST, uaddr_to_user_ptr(copy_address), + if (check_user_ptr_read((void __user *)zc->copybuf_address, zc->copybuf_len)) + return -EFAULT; + + err = import_single_range(ITER_DEST, copy_address, inq, &iov, &msg.msg_iter); if (err) return err; @@ -2113,7 +2116,7 @@ static int tcp_copy_straggler_data(struct tcp_zerocopy_receive *zc, struct sk_buff *skb, u32 copylen, u32 *offset, u32 *seq) { - unsigned long copy_address = (unsigned long)zc->copybuf_address; + __kernel_uintptr_t copy_address = zc->copybuf_address; struct msghdr msg = {}; struct iovec iov; int err; @@ -2121,7 +2124,10 @@ static int tcp_copy_straggler_data(struct tcp_zerocopy_receive *zc, if (copy_address != zc->copybuf_address) return -EINVAL;
- err = import_single_range(ITER_DEST, uaddr_to_user_ptr(copy_address), + if (check_user_ptr_read((void __user *)zc->copybuf_address, zc->copybuf_len)) + return -EFAULT; + + err = import_single_range(ITER_DEST, copy_address, copylen, &iov, &msg.msg_iter); if (err) return err; @@ -2164,7 +2170,7 @@ static int tcp_zc_handle_leftover(struct tcp_zerocopy_receive *zc, static int tcp_zerocopy_vm_insert_batch_error(struct vm_area_struct *vma, struct page **pending_pages, unsigned long pages_remaining, - unsigned long *address, + __kernel_uintptr_t *address, u32 *length, u32 *seq, struct tcp_zerocopy_receive *zc, @@ -2212,7 +2218,7 @@ static int tcp_zerocopy_vm_insert_batch_error(struct vm_area_struct *vma, static int tcp_zerocopy_vm_insert_batch(struct vm_area_struct *vma, struct page **pages, unsigned int pages_to_map, - unsigned long *address, + __kernel_uintptr_t *address, u32 *length, u32 *seq, struct tcp_zerocopy_receive *zc, @@ -2246,11 +2252,11 @@ static void tcp_zc_finalize_rx_tstamp(struct sock *sk, struct tcp_zerocopy_receive *zc, struct scm_timestamping_internal *tss) { - unsigned long msg_control_addr; + __kernel_uintptr_t msg_control_addr; struct msghdr cmsg_dummy;
- msg_control_addr = (unsigned long)zc->msg_control; - cmsg_dummy.msg_control_user = uaddr_to_user_ptr(msg_control_addr); + msg_control_addr = zc->msg_control; + cmsg_dummy.msg_control_user = msg_control_addr; cmsg_dummy.msg_controllen = (__kernel_size_t)zc->msg_controllen; cmsg_dummy.msg_flags = in_compat_syscall() @@ -2274,7 +2280,7 @@ static int tcp_zerocopy_receive(struct sock *sk, struct scm_timestamping_internal *tss) { u32 length = 0, offset, vma_len, avail_len, copylen = 0; - unsigned long address = (unsigned long)zc->address; + __kernel_uintptr_t address = zc->address; struct page *pages[TCP_ZEROCOPY_PAGE_BATCH_SIZE]; s32 copybuf_len = zc->copybuf_len; struct tcp_sock *tp = tcp_sk(sk); @@ -2290,6 +2296,9 @@ static int tcp_zerocopy_receive(struct sock *sk, zc->copybuf_len = 0; zc->msg_flags = 0;
+ if (!check_user_ptr_read((void __user *)zc->address, zc->length)) + return -EFAULT; + if (address & (PAGE_SIZE - 1) || address != zc->address) return -EINVAL;
@@ -4413,7 +4422,7 @@ int do_tcp_getsockopt(struct sock *sk, int level, if (copy_from_sockptr(&len, optlen, sizeof(int))) return -EFAULT; if (len < 0 || - len < offsetofend(struct compat_tcp_zerocopy_receive, length)) + (len < offsetofend(struct compat_tcp_zerocopy_receive, length))) return -EINVAL; if (unlikely(len > tcp_zerocopy_receive_size())) { err = check_zeroed_sockptr(optval, tcp_zerocopy_receive_size(),