Author: trasz
Date: Mon Aug 24 16:27:51 2020
New Revision: 364707
URL: https://svnweb.freebsd.org/changeset/base/364707
Log:
MFC r362941:
Fix Linux recvmsg(2) when msg_namelen returned is 0. Previously
it would fail with EINVAL, breaking some of the Python regression
tests.
While here, cap the user-controlled message length.
Note that the code doesn't seem to be copying out the new length
in either (success or failure) case. This will be addressed separately.
Sponsored by: The FreeBSD Foundation
Modified:
stable/12/sys/compat/linux/linux_socket.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/compat/linux/linux_socket.c
==============================================================================
--- stable/12/sys/compat/linux/linux_socket.c Mon Aug 24 16:25:27 2020
(r364706)
+++ stable/12/sys/compat/linux/linux_socket.c Mon Aug 24 16:27:51 2020
(r364707)
@@ -1195,11 +1195,14 @@ linux_recvmsg_common(struct thread *td, l_int s, struc
if (error != 0)
return (error);
- if (msg->msg_name) {
+ if (msg->msg_name != NULL && msg->msg_namelen > 0) {
+ msg->msg_namelen = min(msg->msg_namelen, SOCK_MAXADDRLEN);
sa = malloc(msg->msg_namelen, M_SONAME, M_WAITOK);
msg->msg_name = sa;
- } else
+ } else {
sa = NULL;
+ msg->msg_name = NULL;
+ }
uiov = msg->msg_iov;
msg->msg_iov = iov;
@@ -1209,7 +1212,10 @@ linux_recvmsg_common(struct thread *td, l_int s, struc
if (error != 0)
goto bad;
- if (msg->msg_name) {
+ /*
+ * Note that kern_recvit() updates msg->msg_namelen.
+ */
+ if (msg->msg_name != NULL && msg->msg_namelen > 0) {
msg->msg_name = PTRIN(linux_msghdr.msg_name);
error = bsd_to_linux_sockaddr(sa, &lsa, msg->msg_namelen);
if (error == 0)
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
