Page MenuHomeFreeBSD

Fix Linux recvmsg(2) when msg_namelen returned is 0
ClosedPublic

Authored by trasz on Jun 21 2020, 7:13 PM.
Tags
None
Referenced Files
Unknown Object (File)
Mon, May 6, 10:13 PM
Unknown Object (File)
Sat, May 4, 1:55 AM
Unknown Object (File)
Fri, Apr 19, 7:48 AM
Unknown Object (File)
Thu, Apr 18, 12:05 PM
Unknown Object (File)
Feb 19 2024, 9:25 AM
Unknown Object (File)
Feb 19 2024, 9:24 AM
Unknown Object (File)
Dec 23 2023, 3:54 AM
Unknown Object (File)
Dec 16 2023, 5:31 AM
Subscribers

Details

Summary

Fix Linux recvmsg(2) when msg_namelen returned is 0. Previously it would fail with EINVAL, breaking some of the Python regression tests.

Note that the code doesn't seem to be copying out the new length in either (success or failure) case. This will be addressed separately.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 32127
Build 29638: arc lint + arc unit

Event Timeline

trasz requested review of this revision.Jun 21 2020, 7:13 PM
trasz retitled this revision from Fix Linux recvmsg(2) when msg_namelen returned is 0. Previously it would fail with EINVAL, breaking some of the Python regression tests. to Fix Linux recvmsg(2) when msg_namelen returned is 0.Jun 21 2020, 8:34 PM
trasz edited the summary of this revision. (Show Details)
trasz added a reviewer: Linux Emulation.
emaste added inline comments.
sys/compat/linux/linux_socket.c
1216–1219

what's msg_namelen's type?

sys/compat/linux/linux_socket.c
1216–1219

It's socklen_t.

sys/compat/linux/linux_socket.c
1199–1200

Is it fine to not check msg_namelen there ?

1216–1219

Fix the style while there, msg_name != NULL ?

sys/compat/linux/linux_socket.c
1216–1219

should it be > 0 not != 0?

trasz added inline comments.
sys/compat/linux/linux_socket.c
1216–1219

Not sure if the check is needed, but better safe than sorry.

sys/compat/linux/linux_socket.c
1201

Is msg_namelen user-controlled ? Does it allow for arbitrary-sized allocations controlled by user ?

1216–1219

Isn't msg_namelen > 0 recheck is redundant ?

sys/compat/linux/linux_socket.c
1201

Hah, good catch!

1216–1219

It isn't, that's the whole point of this change: kern_recvit() updates it. I guess I should add a comment about it.

Add comment explaining the second check, and cap the buffer size.

sys/compat/linux/linux_socket.c
1219

What should the code do if msg->msg_name != NULL but msg->msg_namelen == 0 (after the kern_recvit()) ?

sys/compat/linux/linux_socket.c
1219

My guess is it should copyout the new length. But right now the code does not copyout the length in any case, and like previously, I prefer the small steps approach. I'll mention it in the commit message.

This revision is now accepted and ready to land.Jul 4 2020, 6:38 PM