Commit 7fa875b8 authored by Dylan Yudaken's avatar Dylan Yudaken Committed by Jens Axboe
Browse files

net: copy from user before calling __copy_msghdr 



this is in preparation for multishot receive from io_uring, where it needs
to have access to the original struct user_msghdr.

functionally this should be a no-op.

Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarDylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220714110258.1336200-2-dylany@fb.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 6d2f75a0

include/linux/socket.h

+3 −4
Original line number Diff line number Diff line
@@ -416,10 +416,9 @@ extern int recvmsg_copy_msghdr(struct msghdr *msg, 
			       struct user_msghdr __user *umsg, unsigned flags,

			       struct sockaddr __user **uaddr,

			       struct iovec **iov);

extern int __copy_msghdr_from_user(struct msghdr *kmsg,

				   struct user_msghdr __user *umsg,

				   struct sockaddr __user **save_addr,

				   struct iovec __user **uiov, size_t *nsegs);

extern int __copy_msghdr(struct msghdr *kmsg,

			 struct user_msghdr *umsg,

			 struct sockaddr __user **save_addr);



/* helpers which do the actual work for syscalls */

extern int __sys_recvfrom(int fd, void __user *ubuf, size_t size,

io_uring/net.c

+9 −8
Original line number Diff line number Diff line
@@ -329,31 +329,32 @@ static int __io_recvmsg_copy_hdr(struct io_kiocb *req, 
				 struct io_async_msghdr *iomsg)

{

	struct io_sr_msg *sr = io_kiocb_to_cmd(req);

	struct iovec __user *uiov;

	size_t iov_len;

	struct user_msghdr msg;

	int ret;



	ret = __copy_msghdr_from_user(&iomsg->msg, sr->umsg,

					&iomsg->uaddr, &uiov, &iov_len);

	if (copy_from_user(&msg, sr->umsg, sizeof(*sr->umsg)))

		return -EFAULT;



	ret = __copy_msghdr(&iomsg->msg, &msg, &iomsg->uaddr);

	if (ret)

		return ret;



	if (req->flags & REQ_F_BUFFER_SELECT) {

		if (iov_len == 0) {

		if (msg.msg_iovlen == 0) {

			sr->len = iomsg->fast_iov[0].iov_len = 0;

			iomsg->fast_iov[0].iov_base = NULL;

			iomsg->free_iov = NULL;

		} else if (iov_len > 1) {

		} else if (msg.msg_iovlen > 1) {

			return -EINVAL;

		} else {

			if (copy_from_user(iomsg->fast_iov, uiov, sizeof(*uiov)))

			if (copy_from_user(iomsg->fast_iov, msg.msg_iov, sizeof(*msg.msg_iov)))

				return -EFAULT;

			sr->len = iomsg->fast_iov[0].iov_len;

			iomsg->free_iov = NULL;

		}

	} else {

		iomsg->free_iov = iomsg->fast_iov;

		ret = __import_iovec(READ, uiov, iov_len, UIO_FASTIOV,

		ret = __import_iovec(READ, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV,

				     &iomsg->free_iov, &iomsg->msg.msg_iter,

				     false);

		if (ret > 0)

net/socket.c

+16 −21
Original line number Diff line number Diff line
@@ -2358,25 +2358,20 @@ struct used_address { 
	unsigned int name_len;

};



int __copy_msghdr_from_user(struct msghdr *kmsg,

			    struct user_msghdr __user *umsg,

			    struct sockaddr __user **save_addr,

			    struct iovec __user **uiov, size_t *nsegs)

int __copy_msghdr(struct msghdr *kmsg,

		  struct user_msghdr *msg,

		  struct sockaddr __user **save_addr)

{

	struct user_msghdr msg;

	ssize_t err;



	if (copy_from_user(&msg, umsg, sizeof(*umsg)))

		return -EFAULT;



	kmsg->msg_control_is_user = true;

	kmsg->msg_get_inq = 0;

	kmsg->msg_control_user = msg.msg_control;

	kmsg->msg_controllen = msg.msg_controllen;

	kmsg->msg_flags = msg.msg_flags;

	kmsg->msg_control_user = msg->msg_control;

	kmsg->msg_controllen = msg->msg_controllen;

	kmsg->msg_flags = msg->msg_flags;



	kmsg->msg_namelen = msg.msg_namelen;

	if (!msg.msg_name)

	kmsg->msg_namelen = msg->msg_namelen;

	if (!msg->msg_name)

		kmsg->msg_namelen = 0;



	if (kmsg->msg_namelen < 0)
@@ -2386,11 +2381,11 @@ int __copy_msghdr_from_user(struct msghdr *kmsg, 
		kmsg->msg_namelen = sizeof(struct sockaddr_storage);



	if (save_addr)

		*save_addr = msg.msg_name;

		*save_addr = msg->msg_name;



	if (msg.msg_name && kmsg->msg_namelen) {

	if (msg->msg_name && kmsg->msg_namelen) {

		if (!save_addr) {

			err = move_addr_to_kernel(msg.msg_name,

			err = move_addr_to_kernel(msg->msg_name,

						  kmsg->msg_namelen,

						  kmsg->msg_name);

			if (err < 0)
@@ -2401,12 +2396,10 @@ int __copy_msghdr_from_user(struct msghdr *kmsg, 
		kmsg->msg_namelen = 0;

	}



	if (msg.msg_iovlen > UIO_MAXIOV)

	if (msg->msg_iovlen > UIO_MAXIOV)

		return -EMSGSIZE;



	kmsg->msg_iocb = NULL;

	*uiov = msg.msg_iov;

	*nsegs = msg.msg_iovlen;

	return 0;

}
@@ -2418,8 +2411,10 @@ static int copy_msghdr_from_user(struct msghdr *kmsg, 
	struct user_msghdr msg;

	ssize_t err;



	err = __copy_msghdr_from_user(kmsg, umsg, save_addr, &msg.msg_iov,

					&msg.msg_iovlen);

	if (copy_from_user(&msg, umsg, sizeof(*umsg)))

		return -EFAULT;



	err = __copy_msghdr(kmsg, &msg, save_addr);

	if (err)

		return err;