net: add length argument to skb_copy_and_csum_datagram_iovec
authorSabrina Dubroca <sd@queasysnail.net>
Thu, 15 Oct 2015 12:25:03 +0000 (14:25 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 17 Nov 2015 15:54:45 +0000 (15:54 +0000)
commit127500d724f8c43f452610c9080444eedb5eaa6c
treec2667b2ad3456bc39a3b1b3c3e61951a203521f0
parent4421196453ad90ff54c97b5d600d65464a3965b2
net: add length argument to skb_copy_and_csum_datagram_iovec

Without this length argument, we can read past the end of the iovec in
memcpy_toiovec because we have no way of knowing the total length of the
iovec's buffers.

This is needed for stable kernels where 89c22d8c3b27 ("net: Fix skb
csum races when peeking") has been backported but that don't have the
ioviter conversion, which is almost all the stable trees <= 3.18.

This also fixes a kernel crash for NFS servers when the client uses
 -onfsvers=3,proto=udp to mount the export.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
[bwh: Backported to 3.2: adjust context in include/linux/skbuff.h]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
include/linux/skbuff.h
net/core/datagram.c
net/ipv4/tcp_input.c
net/ipv4/udp.c
net/ipv6/raw.c
net/ipv6/udp.c
net/rxrpc/ar-recvmsg.c