net: add length argument to skb_copy_and_csum_datagram_iovec
authorSabrina Dubroca <sd@queasysnail.net>
Thu, 15 Oct 2015 12:25:03 +0000 (14:25 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 17 Nov 2015 15:54:45 +0000 (15:54 +0000)
Without this length argument, we can read past the end of the iovec in
memcpy_toiovec because we have no way of knowing the total length of the
iovec's buffers.

This is needed for stable kernels where 89c22d8c3b27 ("net: Fix skb
csum races when peeking") has been backported but that don't have the
ioviter conversion, which is almost all the stable trees <= 3.18.

This also fixes a kernel crash for NFS servers when the client uses
 -onfsvers=3,proto=udp to mount the export.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
[bwh: Backported to 3.2: adjust context in include/linux/skbuff.h]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
include/linux/skbuff.h
net/core/datagram.c
net/ipv4/tcp_input.c
net/ipv4/udp.c
net/ipv6/raw.c
net/ipv6/udp.c
net/rxrpc/ar-recvmsg.c

Simple merge
Simple merge
Simple merge
diff --cc net/ipv4/udp.c
Simple merge
diff --cc net/ipv6/raw.c
Simple merge
diff --cc net/ipv6/udp.c
Simple merge
Simple merge