Re: [net-next] tcp: Sanitize CMSG flags and reserved args in tcp_zerocopy_receive.

[Jakub Kicinski]

On Thu, 11 Feb 2021 13:21:07 -0800 Arjun Roy wrote:
> +             if (unlikely(len > sizeof(zc))) {
> +                     err = check_zeroed_user(optval + sizeof(zc),
> +                                             len - sizeof(zc));
> +                     if (err < 1)
> +                             return err == 0 ? -EINVAL : err;

nit: return err ? : -EINVAL;

>                       len = sizeof(zc);
>                       if (put_user(len, optlen))
>                               return -EFAULT;
>               }
>               if (copy_from_user(&zc, optval, len))
>                       return -EFAULT;
> +             if (zc.reserved)
> +                     return -EINVAL;
> +             if (zc.msg_flags &  ~(TCP_VALID_ZC_MSG_FLAGS))

nit: parens unnecessary

But neither is a big deal:

Acked-by: Jakub Kicinski <k...@kernel.org>