Page MenuHomeFreeBSD

Fix Linux recvmsg(2) when msg_namelen returned is 0
ClosedPublic

Authored by trasz on Jun 21 2020, 7:13 PM.

Details

Summary

Fix Linux recvmsg(2) when msg_namelen returned is 0. Previously it would fail with EINVAL, breaking some of the Python regression tests.

Note that the code doesn't seem to be copying out the new length in either (success or failure) case. This will be addressed separately.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

trasz requested review of this revision.Jun 21 2020, 7:13 PM
trasz retitled this revision from Fix Linux recvmsg(2) when msg_namelen returned is 0. Previously it would fail with EINVAL, breaking some of the Python regression tests. to Fix Linux recvmsg(2) when msg_namelen returned is 0.Jun 21 2020, 8:34 PM
trasz edited the summary of this revision. (Show Details)
trasz added a reviewer: Linux Emulation.
emaste added inline comments.
sys/compat/linux/linux_socket.c
1202 ↗(On Diff #73445)

what's msg_namelen's type?

sys/compat/linux/linux_socket.c
1202 ↗(On Diff #73445)

It's socklen_t.

sys/compat/linux/linux_socket.c
1188 ↗(On Diff #73445)

Is it fine to not check msg_namelen there ?

1202 ↗(On Diff #73445)

Fix the style while there, msg_name != NULL ?

sys/compat/linux/linux_socket.c
1202 ↗(On Diff #73445)

should it be > 0 not != 0?

trasz added inline comments.
sys/compat/linux/linux_socket.c
1202 ↗(On Diff #73445)

Not sure if the check is needed, but better safe than sorry.

sys/compat/linux/linux_socket.c
1189 ↗(On Diff #73793)

Is msg_namelen user-controlled ? Does it allow for arbitrary-sized allocations controlled by user ?

1204 ↗(On Diff #73793)

Isn't msg_namelen > 0 recheck is redundant ?

sys/compat/linux/linux_socket.c
1189 ↗(On Diff #73793)

Hah, good catch!

1204 ↗(On Diff #73793)

It isn't, that's the whole point of this change: kern_recvit() updates it. I guess I should add a comment about it.

Add comment explaining the second check, and cap the buffer size.

sys/compat/linux/linux_socket.c
1219 ↗(On Diff #74058)

What should the code do if msg->msg_name != NULL but msg->msg_namelen == 0 (after the kern_recvit()) ?

sys/compat/linux/linux_socket.c
1219 ↗(On Diff #74058)

My guess is it should copyout the new length. But right now the code does not copyout the length in any case, and like previously, I prefer the small steps approach. I'll mention it in the commit message.

This revision is now accepted and ready to land.Jul 4 2020, 6:38 PM