Commit 7fa875b8 authored by Dylan Yudaken's avatar Dylan Yudaken Committed by Jens Axboe

net: copy from user before calling __copy_msghdr

this is in preparation for multishot receive from io_uring, where it needs
to have access to the original struct user_msghdr.

functionally this should be a no-op.
Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarDylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220714110258.1336200-2-dylany@fb.comSigned-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 6d2f75a0
...@@ -416,10 +416,9 @@ extern int recvmsg_copy_msghdr(struct msghdr *msg, ...@@ -416,10 +416,9 @@ extern int recvmsg_copy_msghdr(struct msghdr *msg,
struct user_msghdr __user *umsg, unsigned flags, struct user_msghdr __user *umsg, unsigned flags,
struct sockaddr __user **uaddr, struct sockaddr __user **uaddr,
struct iovec **iov); struct iovec **iov);
extern int __copy_msghdr_from_user(struct msghdr *kmsg, extern int __copy_msghdr(struct msghdr *kmsg,
struct user_msghdr __user *umsg, struct user_msghdr *umsg,
struct sockaddr __user **save_addr, struct sockaddr __user **save_addr);
struct iovec __user **uiov, size_t *nsegs);
/* helpers which do the actual work for syscalls */ /* helpers which do the actual work for syscalls */
extern int __sys_recvfrom(int fd, void __user *ubuf, size_t size, extern int __sys_recvfrom(int fd, void __user *ubuf, size_t size,
......
...@@ -329,31 +329,32 @@ static int __io_recvmsg_copy_hdr(struct io_kiocb *req, ...@@ -329,31 +329,32 @@ static int __io_recvmsg_copy_hdr(struct io_kiocb *req,
struct io_async_msghdr *iomsg) struct io_async_msghdr *iomsg)
{ {
struct io_sr_msg *sr = io_kiocb_to_cmd(req); struct io_sr_msg *sr = io_kiocb_to_cmd(req);
struct iovec __user *uiov; struct user_msghdr msg;
size_t iov_len;
int ret; int ret;
ret = __copy_msghdr_from_user(&iomsg->msg, sr->umsg, if (copy_from_user(&msg, sr->umsg, sizeof(*sr->umsg)))
&iomsg->uaddr, &uiov, &iov_len); return -EFAULT;
ret = __copy_msghdr(&iomsg->msg, &msg, &iomsg->uaddr);
if (ret) if (ret)
return ret; return ret;
if (req->flags & REQ_F_BUFFER_SELECT) { if (req->flags & REQ_F_BUFFER_SELECT) {
if (iov_len == 0) { if (msg.msg_iovlen == 0) {
sr->len = iomsg->fast_iov[0].iov_len = 0; sr->len = iomsg->fast_iov[0].iov_len = 0;
iomsg->fast_iov[0].iov_base = NULL; iomsg->fast_iov[0].iov_base = NULL;
iomsg->free_iov = NULL; iomsg->free_iov = NULL;
} else if (iov_len > 1) { } else if (msg.msg_iovlen > 1) {
return -EINVAL; return -EINVAL;
} else { } else {
if (copy_from_user(iomsg->fast_iov, uiov, sizeof(*uiov))) if (copy_from_user(iomsg->fast_iov, msg.msg_iov, sizeof(*msg.msg_iov)))
return -EFAULT; return -EFAULT;
sr->len = iomsg->fast_iov[0].iov_len; sr->len = iomsg->fast_iov[0].iov_len;
iomsg->free_iov = NULL; iomsg->free_iov = NULL;
} }
} else { } else {
iomsg->free_iov = iomsg->fast_iov; iomsg->free_iov = iomsg->fast_iov;
ret = __import_iovec(READ, uiov, iov_len, UIO_FASTIOV, ret = __import_iovec(READ, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV,
&iomsg->free_iov, &iomsg->msg.msg_iter, &iomsg->free_iov, &iomsg->msg.msg_iter,
false); false);
if (ret > 0) if (ret > 0)
......
...@@ -2358,25 +2358,20 @@ struct used_address { ...@@ -2358,25 +2358,20 @@ struct used_address {
unsigned int name_len; unsigned int name_len;
}; };
int __copy_msghdr_from_user(struct msghdr *kmsg, int __copy_msghdr(struct msghdr *kmsg,
struct user_msghdr __user *umsg, struct user_msghdr *msg,
struct sockaddr __user **save_addr, struct sockaddr __user **save_addr)
struct iovec __user **uiov, size_t *nsegs)
{ {
struct user_msghdr msg;
ssize_t err; ssize_t err;
if (copy_from_user(&msg, umsg, sizeof(*umsg)))
return -EFAULT;
kmsg->msg_control_is_user = true; kmsg->msg_control_is_user = true;
kmsg->msg_get_inq = 0; kmsg->msg_get_inq = 0;
kmsg->msg_control_user = msg.msg_control; kmsg->msg_control_user = msg->msg_control;
kmsg->msg_controllen = msg.msg_controllen; kmsg->msg_controllen = msg->msg_controllen;
kmsg->msg_flags = msg.msg_flags; kmsg->msg_flags = msg->msg_flags;
kmsg->msg_namelen = msg.msg_namelen; kmsg->msg_namelen = msg->msg_namelen;
if (!msg.msg_name) if (!msg->msg_name)
kmsg->msg_namelen = 0; kmsg->msg_namelen = 0;
if (kmsg->msg_namelen < 0) if (kmsg->msg_namelen < 0)
...@@ -2386,11 +2381,11 @@ int __copy_msghdr_from_user(struct msghdr *kmsg, ...@@ -2386,11 +2381,11 @@ int __copy_msghdr_from_user(struct msghdr *kmsg,
kmsg->msg_namelen = sizeof(struct sockaddr_storage); kmsg->msg_namelen = sizeof(struct sockaddr_storage);
if (save_addr) if (save_addr)
*save_addr = msg.msg_name; *save_addr = msg->msg_name;
if (msg.msg_name && kmsg->msg_namelen) { if (msg->msg_name && kmsg->msg_namelen) {
if (!save_addr) { if (!save_addr) {
err = move_addr_to_kernel(msg.msg_name, err = move_addr_to_kernel(msg->msg_name,
kmsg->msg_namelen, kmsg->msg_namelen,
kmsg->msg_name); kmsg->msg_name);
if (err < 0) if (err < 0)
...@@ -2401,12 +2396,10 @@ int __copy_msghdr_from_user(struct msghdr *kmsg, ...@@ -2401,12 +2396,10 @@ int __copy_msghdr_from_user(struct msghdr *kmsg,
kmsg->msg_namelen = 0; kmsg->msg_namelen = 0;
} }
if (msg.msg_iovlen > UIO_MAXIOV) if (msg->msg_iovlen > UIO_MAXIOV)
return -EMSGSIZE; return -EMSGSIZE;
kmsg->msg_iocb = NULL; kmsg->msg_iocb = NULL;
*uiov = msg.msg_iov;
*nsegs = msg.msg_iovlen;
return 0; return 0;
} }
...@@ -2418,8 +2411,10 @@ static int copy_msghdr_from_user(struct msghdr *kmsg, ...@@ -2418,8 +2411,10 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
struct user_msghdr msg; struct user_msghdr msg;
ssize_t err; ssize_t err;
err = __copy_msghdr_from_user(kmsg, umsg, save_addr, &msg.msg_iov, if (copy_from_user(&msg, umsg, sizeof(*umsg)))
&msg.msg_iovlen); return -EFAULT;
err = __copy_msghdr(kmsg, &msg, save_addr);
if (err) if (err)
return err; return err;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment