net: downgrade BUG_ON EIOCBQUEUED in sock_sendmsg_nosec

Browse source

sock_sendmsg_nosec() runs in syscall context but calls BUG_ON() if
proto_ops->sendmsg() returns -EIOCBQUEUED. Crashing the kernel on an
unexpected return value is dangerous for production workloads.

This risk is real: any signed integer overflow in a sendmsg handler
that returns 0xfffffdef (-529, -EIOCBQUEUED) triggers this BUG_ON. In
one month, two such bugs were reported in PF_PACKET, reachable by
a local user with CAP_NET_RAW in a user namespace:
- Commit 73e594c19b ("af_packet: Don't cast tpacket_hdr.tp_len to int
  in tpacket_parse_header().")
- In review ("net/packet: prevent TX_RING byte count overflow")
  https://lore.kernel.org/netdev/20260925124829.6595-1-ilkka.lappetelainen@gmail.com/

Replace the BUG_ON with DEBUG_NET_WARN_ON_ONCE() to retain debug and
syzbot coverage, and return -EIO so that -EIOCBQUEUED does not leak to
userspace or trigger the BUG_ON(ret == -EIOCBQUEUED) in VFS callers of
sock_write_iter() such as new_sync_write().

Failing gracefully is safe because the original reason for the BUG_ON
is gone. It was added in commit 599bd19bdc ("fs: don't allow to complete
sync iocbs through aio_complete") and commit d8725c86ae ("get rid of the
size argument of sock_sendmsg()") to prevent an async completion from
corrupting a caller's on-stack kiocb. Commit 1b78414047 ("net: Remove
iocb argument from sendmsg and recvmsg") removed that on-stack kiocb.
More recently commit fcc77d33a3 ("net: Remove support for AIO on
sockets") removed socket AIO support entirely.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260928020420.3097018-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

...

This commit is contained in:

Willem de Bruijn 2026-09-27 22:03:29 -04:00 • committed by Paolo Abeni

parent 2a5043c8b7

commit ee1972def6

1 changed files with 4 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

net/socket.c

View file