CVE-2024-46783: tcp_bpf: fix return value of tcp_bpf_sendmsg()

In the Linux kernel, the following vulnerability has been resolved:

tcpbpf: fix return value of tcpbpfsendmsg()

When we cork messages in psock->cork, the last message triggers the flushing will result in sending a skmsg larger than the current message size. In this case, in tcpbpfsendverdict(), 'copied' becomes negative at least in the following case:

468 case SKDROP: 469 default: 470 skmsgfreepartial(sk, msg, tosend); 471 skmsgapplybytes(psock, tosend); 472 copied -= (tosend + delta); // <==== HERE 473 return -EACCES;

Therefore, it could lead to the following BUG with a proper value of 'copied' (thanks to syzbot). We should not use negative 'copied' as a return value here.

------------[ cut here ]------------ kernel BUG at net/socket.c:733! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 UID: 0 PID: 3265 Comm: syz-executor510 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0 Hardware name: linux,dummy-virt (DT) pstate: 61400009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : socksendmsgnosec net/socket.c:733 [inline] pc : socksendmsgnosec net/socket.c:728 [inline] pc : socksendmsg+0x5c/0x60 net/socket.c:745 lr : socksendmsgnosec net/socket.c:730 [inline] lr : socksendmsg+0x54/0x60 net/socket.c:745 sp : ffff800088ea3b30 x29: ffff800088ea3b30 x28: fbf00000062bc900 x27: 0000000000000000 x26: ffff800088ea3bc0 x25: ffff800088ea3bc0 x24: 0000000000000000 x23: f9f00000048dc000 x22: 0000000000000000 x21: ffff800088ea3d90 x20: f9f00000048dc000 x19: ffff800088ea3d90 x18: 0000000000000001 x17: 0000000000000000 x16: 0000000000000000 x15: 000000002002ffaf x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: ffff8000815849c0 x9 : ffff8000815b49c0 x8 : 0000000000000000 x7 : 000000000000003f x6 : 0000000000000000 x5 : 00000000000007e0 x4 : fff07ffffd239000 x3 : fbf00000062bc900 x2 : 0000000000000000 x1 : 0000000000000000 x0 : 00000000fffffdef Call trace: socksendmsgnosec net/socket.c:733 [inline] socksendmsg+0x5c/0x60 net/socket.c:745 syssendmsg+0x274/0x2ac net/socket.c:2597 syssendmsg+0xac/0x100 net/socket.c:2651 syssendmsg+0x84/0xe0 net/socket.c:2680 dosyssendmsg net/socket.c:2689 [inline] sesyssendmsg net/socket.c:2687 [inline] arm64syssendmsg+0x24/0x30 net/socket.c:2687 invokesyscall arch/arm64/kernel/syscall.c:35 [inline] invokesyscall+0x48/0x110 arch/arm64/kernel/syscall.c:49 el0svccommon.constprop.0+0x40/0xe0 arch/arm64/kernel/syscall.c:132 doel0svc+0x1c/0x28 arch/arm64/kernel/syscall.c:151 el0svc+0x34/0xec arch/arm64/kernel/entry-common.c:712 el0t64synchandler+0x100/0x12c arch/arm64/kernel/entry-common.c:730 el0t64sync+0x19c/0x1a0 arch/arm64/kernel/entry.S:598 Code: f9404463 d63f0060 3108441f 54fffe81 (d4210000) ---[ end trace 0000000000000000 ]---

— NVD

This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.

— Launchpad