From nobody Mon Jun 15 02:45:07 2026 Received: from hr2.samba.org (hr2.samba.org [144.76.82.148]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA83D370D6E; Tue, 7 Apr 2026 16:03:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=144.76.82.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577826; cv=none; b=apW8F0q55B22N0hZcdpEyeueEtnadQ7IAxhpjKSasXirXwqZRhcCeN+aidyA1W/wcByUQv/CDmmQ4No+9W1P8W8H5i90nZGSfVJfh3gJYh0OqyjJtI6FA8Qda+yV6LHjKx1eFrYBzQ+m2bYG0h4qLzjrX9fI02H2HYqy9noqFoo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577826; c=relaxed/simple; bh=4tzNatN0lLNbSZtg3kjtdU6xpsyEALCIiXGSM4tnjsw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=htr2q5rASAOWnsP/pS7FuOiV8BXeHcJBymsfkZvgh2l2Jx0icPu4ftD2L2ni/+If+8J20xYd7Ri+bOGdMHlKD8vT8e3vw0akqCMrg3/n7shAHHnwovu6V1Q/+CvZ3V0rkzMWJf0KjSe+/lkJtC+0kWCOVCSy9MOR1IO0krCEMLw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org; spf=pass smtp.mailfrom=samba.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b=E8ECd56h; arc=none smtp.client-ip=144.76.82.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=samba.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b="E8ECd56h" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org; s=42; h=Message-ID:Date:Cc:To:From; bh=1sWKeUoiedloG4v+5cKbhOh9byM/6fDeRhbG1bWIQbw=; b=E8ECd56hN1iYhq+ulix96lYfec BSSD9n27nLPltvOqe1wKsaj1T6uNDrDUATj6RviiugjU5Nno1VV1fJElrU9eUfJpb2Zx6MvnmyoEc TUaMlYuOCih63EaAJ2DIG3droMK0b1ra/DVyL2uHRGB5OqWbL1sJ4LZ8sgx/C8vpiyCtUOoKobykU J02WfiwlIIx7K5Bd30TLWS2c3DI+aO4LR2xtGKllZLeD5tikhcTh4oXIQuVGAHEVc+9+gyqxdcQMS rSpNKdkES8O2A6tqQFetsrGkPH7yM+AjbrEGcxZxFX/VAjnSgnGinxBs5BKB68ryi35+JKqJPr6PO rcP/MfA9lzfuitNwQrLujw9FKLXIB0XKMbkKSAQxhmkUcKES65ge65e8Ee6LlSamdqIWvHGruQ1YZ i0fkH+5Q3saPwdqD3H1OXCVVIomY6f0CgRiKp4HnV8Dd+QLemW+dZy/FWJscn2/xLJh6KOgO+lDvt 5olATBcZFV49Qfr0Xw+j1Wwj; Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__ECDSA_SECP256R1_SHA256__CHACHA20_POLY1305:256) (Exim) id 1wA8tp-00000007XiV-1Sez; Tue, 07 Apr 2026 16:03:33 +0000 From: Stefan Metzmacher To: linux-kernel@vger.kernel.org Cc: metze@samba.org, Dmitry Safonov <0x7f454c46@gmail.com>, Dmitry Safonov , Francesco Ruggeri , Salam Noureddine , David Ahern , "David S . Miller" , Michal Luczaj , David Wei , Luiz Augusto von Dentz , Luiz Augusto von Dentz , Marcel Holtmann , Xin Long , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , Neal Cardwell , Jakub Kicinski , Simon Horman , Aleksa Sarai , Christian Brauner , Kees Cook , netdev@vger.kernel.org, linux-bluetooth@vger.kernel.org Subject: [PATCH 1/5] uaccess: fix ignored_trailing logic in copy_struct_to_user() Date: Tue, 7 Apr 2026 18:03:13 +0200 Message-ID: <71f69442410c1186ed8ce6d5b4b9d4a5a70edbad.1775576651.git.metze@samba.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Currently all callers pass ignored_trailing=3DNULL, but I have code that will make use of. Now it actually behaves like documented: * If @usize < @ksize, then the kernel is trying to pass userspace a newer struct than it supports. Thus we only copy the interoperable portions (@usize) and ignore the rest (but @ignored_trailing is set to %true if any of the trailing (@ksize - @usize) bytes are non-zero). Fixes: 424a55a4a908 ("uaccess: add copy_struct_to_user helper") Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher Reviewed-by: Aleksa Sarai --- include/linux/uaccess.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 4fe63169d5a2..1234b5fa4761 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -505,7 +505,7 @@ copy_struct_to_user(void __user *dst, size_t usize, con= st void *src, return -EFAULT; } if (ignored_trailing) - *ignored_trailing =3D ksize < usize && + *ignored_trailing =3D usize < ksize && memchr_inv(src + size, 0, rest) !=3D NULL; /* Copy the interoperable parts of the struct. */ if (copy_to_user(dst, src, size)) --=20 2.43.0 From nobody Mon Jun 15 02:45:07 2026 Received: from hr2.samba.org (hr2.samba.org [144.76.82.148]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF3F23CFF73; Tue, 7 Apr 2026 16:03:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=144.76.82.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577835; cv=none; b=ViDLwvahS6ZfYAqeBDQh2YcCi7C6WwSj78AvbvOTFQ+NRNH449Gb6Imkw7R6vJ79Bb3L2oKVTtTF9E9lpcYFn02Bj+HeeWCeRKYlhChJol3Q5JW5bJpUprdOu7cjpV1sc8Gp67ntvCKUXB9d7WvW7KZqgXeTJup5ExVYsBIIyKs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577835; c=relaxed/simple; bh=4ekckLVHC6JNlQ4+cwG1UzpRHWBEe2fAGVVPOLGy4R4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=d6ajivksdyhx886ntCJV3Uyo13yP1+nhjDucr231qdEteqNf9WviC2fSPAaB8vcV6IJcflsFVcSVWOOpqS6UjuBnD7/hx5z71exJZ2QkPvAvwhZpOdI2lKPNFeVgyBwypERrZpcDCNRib7vsBdeRfmi6m+GL0pLpT2CNr8c1qRs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org; spf=pass smtp.mailfrom=samba.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b=qSo4Red0; arc=none smtp.client-ip=144.76.82.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=samba.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b="qSo4Red0" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org; s=42; h=Message-ID:Date:Cc:To:From; bh=0UZ4nM5ntRTkbDrlVt7CXwcY4ov92h/7RcMa2AIanwA=; b=qSo4Red0hA9iIVZtglDgmQLDfC l5JsDBXdO2/CzltDZtArJ4WwV7NzmC6BPplR8N9aSXQlWZ+Aoj8ssFPheD5Qgr9ADG+KzZtMmEwlk Ayfztl85Vp5HGr5uPyA0FDSlj/nNw9cVlFDfs814fxOnU+NQ48WeVIZvZ2nZz7Oc1XkjGpy1Iw5sU wMiDBznHnatewtVKvOTWD1EE978yng7itidLTymOVgVgh19p67I5SHWDLXGAZDCYuWA4pCKa7Jyhk vQw/igIiANmjHC8oGi3RrpdJaeU9Bs1UXGVggt2BF9w+T2kL/yzJu3NsPpg85XPMOewyXNDOFzDUn oGwU/nxRyLi2z0JzyNV1pXny7S+ulV0cDL2voK66VxjQoIhvISTE2hvuMWv55Pcge4VtK1y5gBXYp zC0qYo3zeS+vCf6xGjawJo8Ty0j/tFUywUyEj4wSCtccFVxsp6/qoDzOWBVZ1pt/V1XDw9sLe5X2O x0haqQ6CLkoU/ZdEOI1T7i6s; Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__ECDSA_SECP256R1_SHA256__CHACHA20_POLY1305:256) (Exim) id 1wA8tv-00000007Xj8-0Juu; Tue, 07 Apr 2026 16:03:39 +0000 From: Stefan Metzmacher To: linux-kernel@vger.kernel.org Cc: metze@samba.org, Dmitry Safonov <0x7f454c46@gmail.com>, Dmitry Safonov , Francesco Ruggeri , Salam Noureddine , David Ahern , "David S . Miller" , Michal Luczaj , David Wei , Luiz Augusto von Dentz , Luiz Augusto von Dentz , Marcel Holtmann , Xin Long , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , Neal Cardwell , Jakub Kicinski , Simon Horman , Aleksa Sarai , Christian Brauner , Kees Cook , netdev@vger.kernel.org, linux-bluetooth@vger.kernel.org Subject: [PATCH 2/5] sockptr: fix usize check in copy_struct_from_sockptr() for user pointers Date: Tue, 7 Apr 2026 18:03:14 +0200 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" copy_struct_from_user will never hit the check_zeroed_user() call and will never return -E2BIG if new userspace passed new bits in a larger structure than the current kernel structure. As far as I can there are no critical/related uapi changes in - include/net/bluetooth/bluetooth.h and net/bluetooth/sco.c after the use of copy_struct_from_sockptr in v6.13-rc3 - include/uapi/linux/tcp.h and net/ipv4/tcp_ao.c after the use of copy_struct_from_sockptr in v6.6-rc1 So that new callers will get the correct behavior from the start. Fixes: 4954f17ddefc ("net/tcp: Introduce TCP_AO setsockopt()s") Fixes: ef84703a911f ("net/tcp: Add TCP-AO getsockopt()s") Fixes: faadfaba5e01 ("net/tcp: Add TCP_AO_REPAIR") Fixes: 3e643e4efa1e ("Bluetooth: Improve setsockopt() handling of malformed= user input") Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher Reviewed-by: Aleksa Sarai --- include/linux/sockptr.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h index 3e6c8e9d67ae..ba88f4d78c1b 100644 --- a/include/linux/sockptr.h +++ b/include/linux/sockptr.h @@ -91,7 +91,7 @@ static inline int copy_struct_from_sockptr(void *dst, siz= e_t ksize, size_t rest =3D max(ksize, usize) - size; =20 if (!sockptr_is_kernel(src)) - return copy_struct_from_user(dst, ksize, src.user, size); + return copy_struct_from_user(dst, ksize, src.user, usize); =20 if (usize < ksize) { memset(dst + size, 0, rest); --=20 2.43.0 From nobody Mon Jun 15 02:45:07 2026 Received: from hr2.samba.org (hr2.samba.org [144.76.82.148]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0FBD13D1CA0; Tue, 7 Apr 2026 16:03:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=144.76.82.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577842; cv=none; b=BGLx+X0xHSYqJamEsk/qrf36pieE13/m1UgcdsPEzlL7RDyxmBGyHtMZ8n6FU1rU3jvyseQViGLaJ0VtbEdoL5OvRGkLWWkiPds72Sy0I8kXBELBi5Lb9VJ7oHq5KcioLB0UsBwjFApYr5LttQ0ZMAS41Fwvxg8l+5oMcrRAQXg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577842; c=relaxed/simple; bh=FWMfd4yEZoHIlu5luv1+ztRX+2BUPIE7X09RroYvLzY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oB1LcydSGRWY/M/EBZSiVvWXtda7Q+tEuPvxowxi0zFmrSH/mSJXDW4AnOvcmmniEqhhv/A8DPVd3h8lezJN4YQDobLjLoLEX/1hCIa+lp7j1Xg1ZKgGWwF+78QNkfkSnDhZ4Q5kfXn73TYRLCKHsCm+TjnfCRpYZccbIpZkNNw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org; spf=pass smtp.mailfrom=samba.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b=1uUaBP75; arc=none smtp.client-ip=144.76.82.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=samba.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b="1uUaBP75" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org; s=42; h=Message-ID:Date:Cc:To:From; bh=QCAv72jbBIAtTDnzhZIyAqvyUFhGw6j7cPQDLw9NObA=; b=1uUaBP75Ys14D6HcBWqrdyGS0g mBbWVgPvTGWnAJgaHv3k736UUiqAETp273iQ2hWevvyRzfSkrSfM/dOowzDCUN5ILbJDj58G5Xnoc 3tfUEpWFs0BnFzp8wRdPYcB6Npg1rRNboC8Zhj7DTT6dw28HdN53j/7NQHPsYxDIcIkFnbZUwTjGD yY3oo8xmbkqGkSxtQaKINztYOoLOvgBsBueZpsJ65X2exPtGJGTE1iXxqDbb46b9UlIW7SuMfkHdG REYfK+evCYf0W5cLBxN8G6iRlKZCmBxSdyrrTiBBCLV/bFz58fYbyM3uE28GWExHkSKB1e6x4yLJx VZMeu24fFstazA4dyHkt6UOB3mQhSr1TgPfApyS5ZvGGB9cXTGCYr19uFcyokmpGoec4uB8PG7wOb NuuduNmOzQbqvoZtHp8eEBCOU+mZiVqFvUyNhozZn7dD89OkAb5EglxXpSQqcWzYthYBo0hrEgNTl MkCiYhhprowhTP/I25xR8/fL; Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__ECDSA_SECP256R1_SHA256__CHACHA20_POLY1305:256) (Exim) id 1wA8u0-00000007Xjb-3ZOC; Tue, 07 Apr 2026 16:03:44 +0000 From: Stefan Metzmacher To: linux-kernel@vger.kernel.org Cc: metze@samba.org, Dmitry Safonov <0x7f454c46@gmail.com>, Dmitry Safonov , Francesco Ruggeri , Salam Noureddine , David Ahern , "David S . Miller" , Michal Luczaj , David Wei , Luiz Augusto von Dentz , Luiz Augusto von Dentz , Marcel Holtmann , Xin Long , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , Neal Cardwell , Jakub Kicinski , Simon Horman , Aleksa Sarai , Christian Brauner , Kees Cook , netdev@vger.kernel.org, linux-bluetooth@vger.kernel.org Subject: [PATCH 3/5] uaccess: add copy_struct_{from,to}_bounce_buffer() helpers Date: Tue, 7 Apr 2026 18:03:15 +0200 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" These are similar to copy_struct_{from,to}_user() but operate on kernel buffers instead of user buffers. They can be used when there is a temporary bounce buffer used, e.g. in msg_control or similar places. It allows us to have the same logic to handle old vs. current and current vs. new structures in the same compatible way. copy_struct_from_sockptr() will also be able to use copy_struct_from_bounce_buffer() for the kernel case as follow us patch. I'll use this in my IPPROTO_SMBDIRECT work, but maybe it will also be useful for others... IPPROTO_QUIC will likely also use it. Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher --- include/linux/uaccess.h | 63 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h index 1234b5fa4761..a6cd4f48bb99 100644 --- a/include/linux/uaccess.h +++ b/include/linux/uaccess.h @@ -513,6 +513,69 @@ copy_struct_to_user(void __user *dst, size_t usize, co= nst void *src, return 0; } =20 +static __always_inline void +__copy_struct_generic_bounce_buffer(void *dst, size_t dstsize, + const void *src, size_t srcsize, + bool *ignored_trailing) +{ + size_t size =3D min(dstsize, srcsize); + size_t rest =3D max(dstsize, srcsize) - size; + + /* Deal with trailing bytes. */ + if (dstsize > srcsize) + memset(dst + size, 0, rest); + if (ignored_trailing) + *ignored_trailing =3D dstsize < srcsize && + memchr_inv(src + size, 0, rest) !=3D NULL; + /* Copy the interoperable parts of the struct. */ + memcpy(dst, src, size); +} + +/** + * This is like copy_struct_from_user(), but the + * src buffer was already copied into a kernel + * bounce buffer, so it will never return -EFAULT. + */ +static __always_inline __must_check int +copy_struct_from_bounce_buffer(void *dst, size_t dstsize, + const void *src, size_t srcsize) +{ + bool ignored_trailing; + + /* Double check if ksize is larger than a known object size. */ + if (WARN_ON_ONCE(dstsize > __builtin_object_size(dst, 1))) + return -E2BIG; + + __copy_struct_generic_bounce_buffer(dst, dstsize, + src, srcsize, + &ignored_trailing); + if (unlikely(ignored_trailing)) + return -E2BIG; + + return 0; +} + +/** + * This is like copy_struct_to_user(), but the + * dst buffer is a kernel bounce buffer instead + * of a direct userspace buffer, so it will never return -EFAULT. + */ +static __always_inline __must_check int +copy_struct_to_bounce_buffer(void *dst, size_t dstsize, + const void *src, + size_t srcsize, + bool *ignored_trailing) +{ + /* Double check if srcsize is larger than a known object size. */ + if (WARN_ON_ONCE(srcsize > __builtin_object_size(src, 1))) + return -E2BIG; + + __copy_struct_generic_bounce_buffer(dst, dstsize, + src, srcsize, + ignored_trailing); + return 0; +} + bool copy_from_kernel_nofault_allowed(const void *unsafe_src, size_t size); =20 long copy_from_kernel_nofault(void *dst, const void *src, size_t size); --=20 2.43.0 From nobody Mon Jun 15 02:45:07 2026 Received: from hr2.samba.org (hr2.samba.org [144.76.82.148]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7ED13D1CB6; Tue, 7 Apr 2026 16:03:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=144.76.82.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577845; cv=none; b=t6wt8dqfvEsKvrS7YHdm34mD4WpvyPwqHz1a7wJ+Sswiq1LO6wwwyty0OQuhHLP1s1s9V518/8T4JOymVh1geJxGMpJDBMLI4/CSx8Vt+52otWHcgCKgq8mLI5Xs9wcMkbZCL6GKTomhRAc8NWkDQmRjbIwLWVpwj1cqZdr+Rj8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577845; c=relaxed/simple; bh=wHapa6bYWvJzvpoBm8/tnoueHb8aD9aXe9o4B9DjhoQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C8JECfXb9ZpXjeacT7I5VbdhPrrYqi0LNEEUC5e3hwtvPut3oqlKAYAHdO1DMiGLw0z7nqPyzvWeJZp8Sb4uYdolcGGUQAq6a4a1l5o+XpqpQc5SaeNf42GNuwJ/+2s/Oa7nJamNvifEPFzghhvEu6vqCgu+zbEagmA6laYnIL8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org; spf=pass smtp.mailfrom=samba.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b=d29tw00A; arc=none smtp.client-ip=144.76.82.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=samba.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b="d29tw00A" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org; s=42; h=Message-ID:Date:Cc:To:From; bh=TbrjwGo14PmyvPU5IuDe4577IkjzAwCCxvuZ9TVYC1s=; b=d29tw00A1K/qlUbkw3/tldt/0+ T5BRYVIH9OjG2rCTK7MAGPK0ECcWTdXrA9EM7SOAB9prk/bmwWsizRvrOOzbitJtjG2Gwm3WFeRL/ 4iZdVq6g7ew51RTmVyebzqq113yoLmOtUlBF48AYEygkhAYn6SR7nn3gu/avFK9LBxN99Mvl9WLOl 8ieGv4jApxY9oKqEh1TF36KY28RASNSSjyp8L7P43Sa3p/ToOeeMWztWrESq7KQULkAZmkqZy7yry r6dBqNg8wF9otrPINe+ykFoE68ZZRK2AA2W1Wf66eNmDHTkLRKv2uB1y+iFn9HLG/Qm99wB1y7qDV CzXS5begpBL8ZHbqD7MdnTpOE+WbkEDxImMVl5TjV0X1TaaGS7spQb1YTO0bFFRabGMcSGChQuNcL LMwGFPWNdhe3/PV5GDer27EARLhK/I5qaJUOvlmIOY0hH2BLoYRdzbuBZBfrZtbsmsE9D3k6G92PL K/uLP90F8QDUYa/ct5cW+81u; Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__ECDSA_SECP256R1_SHA256__CHACHA20_POLY1305:256) (Exim) id 1wA8u6-00000007XkD-2WGJ; Tue, 07 Apr 2026 16:03:50 +0000 From: Stefan Metzmacher To: linux-kernel@vger.kernel.org Cc: metze@samba.org, Dmitry Safonov <0x7f454c46@gmail.com>, Dmitry Safonov , Francesco Ruggeri , Salam Noureddine , David Ahern , "David S . Miller" , Michal Luczaj , David Wei , Luiz Augusto von Dentz , Luiz Augusto von Dentz , Marcel Holtmann , Xin Long , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , Neal Cardwell , Jakub Kicinski , Simon Horman , Aleksa Sarai , Christian Brauner , Kees Cook , netdev@vger.kernel.org, linux-bluetooth@vger.kernel.org Subject: [PATCH 4/5] sockptr: let copy_struct_from_sockptr() use copy_struct_from_bounce_buffer() Date: Tue, 7 Apr 2026 18:03:16 +0200 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The world would be better without sockptr_t, but this at least simplifies copy_struct_from_sockptr() to be just a dispatcher for copy_struct_from_user() or copy_struct_from_bounce_buffer() without any special logic on its own. Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher --- include/linux/sockptr.h | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h index ba88f4d78c1b..706a8526cf3c 100644 --- a/include/linux/sockptr.h +++ b/include/linux/sockptr.h @@ -87,24 +87,10 @@ static inline int copy_safe_from_sockptr(void *dst, siz= e_t ksize, static inline int copy_struct_from_sockptr(void *dst, size_t ksize, sockptr_t src, size_t usize) { - size_t size =3D min(ksize, usize); - size_t rest =3D max(ksize, usize) - size; - if (!sockptr_is_kernel(src)) return copy_struct_from_user(dst, ksize, src.user, usize); =20 - if (usize < ksize) { - memset(dst + size, 0, rest); - } else if (usize > ksize) { - char *p =3D src.kernel; - - while (rest--) { - if (*p++) - return -E2BIG; - } - } - memcpy(dst, src.kernel, size); - return 0; + return copy_struct_from_bounce_buffer(dst, ksize, src.kernel, usize); } =20 static inline int copy_to_sockptr_offset(sockptr_t dst, size_t offset, --=20 2.43.0 From nobody Mon Jun 15 02:45:07 2026 Received: from hr2.samba.org (hr2.samba.org [144.76.82.148]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C67FD3D649F; Tue, 7 Apr 2026 16:03:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=144.76.82.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577847; cv=none; b=EGYDAU/M2hO6Z9xYHV76nObReZm/j2ha1HRY47mX2pbLoZfbRjhhOWBx01MbawmmMnDA3SOkMaS4vgG81fU8Pq24/fhQ+OE7CPYy1OVMkUaBKGDuVDh+9wgDoyBBSZGVsSdZtxkxl+ikqK/gnN/HycfYN+xQMYrBmO91fdXArXo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775577847; c=relaxed/simple; bh=TAHbJ8shCUysdP4d22ZFghQI2jeDo3bLaktPKkLvi3w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nTCBuMGuI7UzrgBriEaItGSM6MQPQ051SG/PGy3Tlrm/ee1Ol8XAYNhYsS8+k7CKfxYWPv88aI6TryITXxstC/3Ats0kof4LAvDfcCEHPib8ARmHlkLQUQZPmGjBFwkEAt4vYuwEdUOw7zeyDjgdA0Z7CLVUoiPYFYA9ULz8g2k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org; spf=pass smtp.mailfrom=samba.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b=bh2U4TGB; arc=none smtp.client-ip=144.76.82.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=samba.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=samba.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (3072-bit key) header.d=samba.org header.i=@samba.org header.b="bh2U4TGB" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org; s=42; h=Message-ID:Date:Cc:To:From; bh=vIAh/1ZMFfnKbOCb9A/NbitCMcGGjkXhI3WpqSRlpLI=; b=bh2U4TGB9VGY9vtQW4X15pPD7Q 5CjfNPNASTyFRx6XQjQqK+GSVYy66EPSINPXK0EovcAWjWAaGH2Uej/8dyqRJn4uloBr2wf40GGGk 6Pm/oEIml6zdFeUwm3ivA5WGeXSDOQec/gly5IlQzvKoeoVcUMpuX6JBrmHaQEjX29DCMPsSAFH2L dgeJplxifyTCW7xVUk+dosT7gneAwH1xcXCDoEmWn5S8cZX3/DrY/+4pvSmLiIjjGaPPdtZtR8aaw iP9CEC2RPHZz3KQ64pf+XmMgejT7UxqN1PDVhDlPpSvuCWuN5xu9R1YOWZ8vJHTV6JNr/feYTtInf pyyFLqrQzSn17xuUhzSFxLrEIJMVfHA74JYd3zLDj22RK/edgGoQ6EPlGFn83PZ4j4AQUYFpwQsWF WghxJGTlOb7/6XAurEngk2aQOriVo/6iJmJ5/d8Tz5pwdr+KuVXWvyGPjlCJ0Pbng5z7/stjrtyje MPWJ6YI9AUGLYXmZFS5fQGDw; Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.3:ECDHE_SECP256R1__ECDSA_SECP256R1_SHA256__CHACHA20_POLY1305:256) (Exim) id 1wA8uC-00000007Xkj-1c22; Tue, 07 Apr 2026 16:03:56 +0000 From: Stefan Metzmacher To: linux-kernel@vger.kernel.org Cc: metze@samba.org, Dmitry Safonov <0x7f454c46@gmail.com>, Dmitry Safonov , Francesco Ruggeri , Salam Noureddine , David Ahern , "David S . Miller" , Michal Luczaj , David Wei , Luiz Augusto von Dentz , Luiz Augusto von Dentz , Marcel Holtmann , Xin Long , Eric Dumazet , Kuniyuki Iwashima , Paolo Abeni , Willem de Bruijn , Neal Cardwell , Jakub Kicinski , Simon Horman , Aleksa Sarai , Christian Brauner , Kees Cook , netdev@vger.kernel.org, linux-bluetooth@vger.kernel.org Subject: [PATCH 5/5] sockptr: introduce copy_struct_to_sockptr() Date: Tue, 7 Apr 2026 18:03:17 +0200 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" We already have copy_struct_from_sockptr() as wrapper to copy_struct_from_user() or copy_struct_from_bounce_buffer(), so it's good to have copy_struct_to_sockptr() as well matching the behavior of copy_struct_to_user() or copy_struct_to_bounce_buffer(). The world would be better without sockptr_t, but having copy_struct_to_sockptr() is better than open code it in various places. I'll use this in my IPPROTO_SMBDIRECT work, but maybe it will also be useful for others... IPPROTO_QUIC will likely also use it. Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Dmitry Safonov Cc: Francesco Ruggeri Cc: Salam Noureddine Cc: David Ahern Cc: David S. Miller Cc: Michal Luczaj Cc: David Wei Cc: Luiz Augusto von Dentz Cc: Luiz Augusto von Dentz Cc: Marcel Holtmann Cc: Xin Long Cc: Eric Dumazet Cc: Kuniyuki Iwashima Cc: Paolo Abeni Cc: Willem de Bruijn Cc: Neal Cardwell Cc: Jakub Kicinski Cc: Simon Horman Cc: Aleksa Sarai Cc: Christian Brauner CC: Kees Cook Cc: netdev@vger.kernel.org Cc: linux-bluetooth@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Stefan Metzmacher --- include/linux/sockptr.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/include/linux/sockptr.h b/include/linux/sockptr.h index 706a8526cf3c..9c2429c1a570 100644 --- a/include/linux/sockptr.h +++ b/include/linux/sockptr.h @@ -107,6 +107,16 @@ static inline int copy_to_sockptr(sockptr_t dst, const= void *src, size_t size) return copy_to_sockptr_offset(dst, 0, src, size); } =20 +static inline int +copy_struct_to_sockptr(sockptr_t dst, size_t usize, const void *src, + size_t ksize, bool *ignored_trailing) +{ + if (!sockptr_is_kernel(dst)) + return copy_struct_to_user(dst.user, usize, src, ksize, ignored_trailing= ); + + return copy_struct_to_bounce_buffer(dst.kernel, usize, src, ksize, ignore= d_trailing); +} + static inline void *memdup_sockptr_noprof(sockptr_t src, size_t len) { void *p =3D kmalloc_track_caller_noprof(len, GFP_USER | __GFP_NOWARN); --=20 2.43.0