tun: fix tun_chr_aio_write so that aio works

aio_write gets const struct iovec * but tun_chr_aio_write casts this to struct
iovec * and modifies the iovec. As a result, attempts to use io_submit
to send packets to a tun device fail with weird errors such as EINVAL.

Since tun is the only user of skb_copy_datagram_from_iovec, we can
fix this simply by changing the later so that it does not
touch the iovec passed to it.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 18 insertions, 9 deletions

diff --git a/net/core/datagram.c b/net/core/datagram.c
index 4dbb05cd572b..914d5fa773b4 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -435,13 +435,15 @@ EXPORT_SYMBOL(skb_copy_datagram_const_iovec);
  *      @skb: buffer to copy
  *      @offset: offset in the buffer to start copying to
  *      @from: io vector to copy to
+ *      @from_offset: offset in the io vector to start copying from
  *      @len: amount of data to copy to buffer from iovec
  *
  *      Returns 0 or -EFAULT.
- *      Note: the iovec is modified during the copy.
+ *      Note: the iovec is not modified during the copy.
  */
 int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
-                                 struct iovec *from, int len)
+                                 const struct iovec *from, int from_offset,
+                                 int len)
 {
         int start = skb_headlen(skb);
         int i, copy = start - offset;
@@ -450,11 +452,12 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
         if (copy > 0) {
                 if (copy > len)
                         copy = len;
-                if (memcpy_fromiovec(skb->data + offset, from, copy))
+                if (memcpy_fromiovecend(skb->data + offset, from, 0, copy))
                         goto fault;
                 if ((len -= copy) == 0)
                         return 0;
                 offset += copy;
+                from_offset += copy;
         }
 
         /* Copy paged appendix. Hmm... why does this look so complicated? */
@@ -473,8 +476,9 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                         if (copy > len)
                                 copy = len;
                         vaddr = kmap(page);
-                        err = memcpy_fromiovec(vaddr + frag->page_offset +
-                                               offset - start, from, copy);
+                        err = memcpy_fromiovecend(vaddr + frag->page_offset +
+                                                  offset - start,
+                                                  from, from_offset, copy);
                         kunmap(page);
                         if (err)
                                 goto fault;
@@ -482,6 +486,7 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                         if (!(len -= copy))
                                 return 0;
                         offset += copy;
+                        from_offset += copy;
                 }
                 start = end;
         }
@@ -500,11 +505,14 @@ int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
                                         copy = len;
                                 if (skb_copy_datagram_from_iovec(list,
                                                                  offset - start,
-                                                                 from, copy))
+                                                                 from,
+                                                                 from_offset,
+                                                                 copy))
                                         goto fault;
                                 if ((len -= copy) == 0)
                                         return 0;
                                 offset += copy;
+                                from_offset += copy;
                         }
                         start = end;
                 }
diff --git a/net/core/iovec.c b/net/core/iovec.c
index a215545c0a34..40a76ce19d9f 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -147,10 +147,11 @@ int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len)
 }
 
 /*
- *      For use with ip_build_xmit
+ *      Copy iovec from kernel. Returns -EFAULT on error.
  */
-int memcpy_fromiovecend(unsigned char *kdata, struct iovec *iov, int offset,
-                        int len)
+
+int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+                        int offset, int len)
 {
         /* Skip over the finished iovecs */
         while (offset >= iov->iov_len) {