Revert "net: add length argument to skb_copy_and_csum_datagram_iovec"

This reverts commit 127500d724f8c43f452610c9080444eedb5eaa6c.  That fixed
the problem of buffer over-reads introduced by backporting commit
89c22d8c3b27 ("net: Fix skb csum races when peeking"), but resulted in
incorrect checksumming for short reads.  It will be replaced with a
complete fix.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index d0c9e6d..d9c4a60 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -2134,8 +2134,7 @@ extern int               skb_copy_datagram_iovec(const struct sk_buff *from,
                                               int size);
 extern int            skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
                                                        int hlen,
                                               int size);
 extern int            skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
                                                        int hlen,

-                                                       struct iovec *iov,
-                                                       int len);
+                                                       struct iovec *iov);

 extern int            skb_copy_datagram_from_iovec(struct sk_buff *skb,
                                                    int offset,
                                                    const struct iovec *from,
 extern int            skb_copy_datagram_from_iovec(struct sk_buff *skb,
                                                    int offset,
                                                    const struct iovec *from,

diff --git a/net/core/datagram.c b/net/core/datagram.c
index 6616bfb..a496313 100644 (file)
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -709,7 +709,6 @@ EXPORT_SYMBOL(__skb_checksum_complete);
  *     @skb: skbuff
  *     @hlen: hardware length
  *     @iov: io vector
  *     @skb: skbuff
  *     @hlen: hardware length
  *     @iov: io vector

- *     @len: amount of data to copy from skb to iov

  *
  *     Caller _must_ check that skb will fit to this iovec.
  *
  *
  *     Caller _must_ check that skb will fit to this iovec.
  *


@@ -719,14 +718,11 @@ EXPORT_SYMBOL(__skb_checksum_complete);
  *                        can be modified!
  */
 int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,
  *                        can be modified!
  */
 int skb_copy_and_csum_datagram_iovec(struct sk_buff *skb,

-                                    int hlen, struct iovec *iov, int len)
+                                    int hlen, struct iovec *iov)

 {
        __wsum csum;
        int chunk = skb->len - hlen;
 
 {
        __wsum csum;
        int chunk = skb->len - hlen;
 

-       if (chunk > len)
-               chunk = len;
-

        if (!chunk)
                return 0;
 
        if (!chunk)
                return 0;
 

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3877e16..039e40f 100644 (file)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5198,7 +5198,7 @@ static int tcp_copy_to_iovec(struct sock *sk, struct sk_buff *skb, int hlen)
                err = skb_copy_datagram_iovec(skb, hlen, tp->ucopy.iov, chunk);
        else
                err = skb_copy_and_csum_datagram_iovec(skb, hlen,
                err = skb_copy_datagram_iovec(skb, hlen, tp->ucopy.iov, chunk);
        else
                err = skb_copy_and_csum_datagram_iovec(skb, hlen,

-                                                      tp->ucopy.iov, chunk);
+                                                      tp->ucopy.iov);

 
        if (!err) {
                tp->ucopy.len -= chunk;
 
        if (!err) {
                tp->ucopy.len -= chunk;

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b111221..5e92043 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1207,7 +1207,7 @@ try_again:
        else {
                err = skb_copy_and_csum_datagram_iovec(skb,
                                                       sizeof(struct udphdr),
        else {
                err = skb_copy_and_csum_datagram_iovec(skb,
                                                       sizeof(struct udphdr),

-                                                      msg->msg_iov, copied);
+                                                      msg->msg_iov);

 
                if (err == -EINVAL)
                        goto csum_copy_err;
 
                if (err == -EINVAL)
                        goto csum_copy_err;

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d1e528c..bebc821 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -479,7 +479,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                        goto csum_copy_err;
                err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
        } else {
                        goto csum_copy_err;
                err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
        } else {

-               err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov, copied);
+               err = skb_copy_and_csum_datagram_iovec(skb, 0, msg->msg_iov);

                if (err == -EINVAL)
                        goto csum_copy_err;
        }
                if (err == -EINVAL)
                        goto csum_copy_err;
        }

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 3308803..15f75e4 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -383,8 +383,7 @@ try_again:
                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
                                              msg->msg_iov, copied       );
        else {
                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
                                              msg->msg_iov, copied       );
        else {

-               err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr),
-                                                      msg->msg_iov, copied);
+               err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);

                if (err == -EINVAL)
                        goto csum_copy_err;
        }
                if (err == -EINVAL)
                        goto csum_copy_err;
        }

diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index c67f5d3..5cc2da5 100644 (file)
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -185,8 +185,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
                                                      msg->msg_iov, copy);
                } else {
                        ret = skb_copy_and_csum_datagram_iovec(skb, offset,
                                                      msg->msg_iov, copy);
                } else {
                        ret = skb_copy_and_csum_datagram_iovec(skb, offset,

-                                                              msg->msg_iov,
-                                                              copy);
+                                                              msg->msg_iov);

                        if (ret == -EINVAL)
                                goto csum_copy_error;
                }
                        if (ret == -EINVAL)
                                goto csum_copy_error;
                }