Page MenuHomeFreeBSD

Fix Linux recvmsg(2) when msg_namelen returned is 0
ClosedPublic

Authored by trasz on Jun 21 2020, 7:13 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, May 6, 10:13 PM
Unknown Object (File)
Sat, May 4, 1:55 AM
Unknown Object (File)
Fri, Apr 19, 7:48 AM
Unknown Object (File)
Thu, Apr 18, 12:05 PM
Unknown Object (File)
Feb 19 2024, 9:25 AM
Unknown Object (File)
Feb 19 2024, 9:24 AM
Unknown Object (File)
Dec 23 2023, 3:54 AM
Unknown Object (File)
Dec 16 2023, 5:31 AM
Subscribers

Details

Summary

Fix Linux recvmsg(2) when msg_namelen returned is 0. Previously it would fail with EINVAL, breaking some of the Python regression tests.

Note that the code doesn't seem to be copying out the new length in either (success or failure) case. This will be addressed separately.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 31863
Build 29422: arc lint + arc unit

Event Timeline

trasz requested review of this revision.Jun 21 2020, 7:13 PM
trasz retitled this revision from Fix Linux recvmsg(2) when msg_namelen returned is 0. Previously it would fail with EINVAL, breaking some of the Python regression tests. to Fix Linux recvmsg(2) when msg_namelen returned is 0.Jun 21 2020, 8:34 PM
trasz edited the summary of this revision. (Show Details)
trasz added a reviewer: Linux Emulation.
emaste added inline comments.
sys/compat/linux/linux_socket.c
1202

what's msg_namelen's type?

sys/compat/linux/linux_socket.c
1202

It's socklen_t.

sys/compat/linux/linux_socket.c
1188

Is it fine to not check msg_namelen there ?

1202

Fix the style while there, msg_name != NULL ?

sys/compat/linux/linux_socket.c
1202

should it be > 0 not != 0?

trasz added inline comments.
sys/compat/linux/linux_socket.c
1202

Not sure if the check is needed, but better safe than sorry.

sys/compat/linux/linux_socket.c
1189

Is msg_namelen user-controlled ? Does it allow for arbitrary-sized allocations controlled by user ?

1202

Isn't msg_namelen > 0 recheck is redundant ?

sys/compat/linux/linux_socket.c
1189

Hah, good catch!

1202

It isn't, that's the whole point of this change: kern_recvit() updates it. I guess I should add a comment about it.

Add comment explaining the second check, and cap the buffer size.

sys/compat/linux/linux_socket.c
1205

What should the code do if msg->msg_name != NULL but msg->msg_namelen == 0 (after the kern_recvit()) ?

sys/compat/linux/linux_socket.c
1205

My guess is it should copyout the new length. But right now the code does not copyout the length in any case, and like previously, I prefer the small steps approach. I'll mention it in the commit message.

This revision is now accepted and ready to land.Jul 4 2020, 6:38 PM