Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-21 19:41:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

net: copy from user before calling __get_compat_msghdr

Browse Source 
this is in preparation for multishot receive from io_uring, where it needs
to have access to the original struct user_msghdr.

functionally this should be a no-op.

Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Dylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220714110258.1336200-3-dylany@fb.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Dylan Yudaken 2022-07-14 04:02:57 -07:00 committed by Jens Axboe
parent 7fa875b8e5
commit 72c531f8ef
3 changed files with 28 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/net/compat.h
View File

@ -46,9 +46,8 @@ struct compat_rtentry {
unsigned short rt_irtt; /* Initial RTT */ unsigned short rt_irtt; /* Initial RTT */
}; };
int __get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg, int __get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr *msg,
struct sockaddr __user **save_addr, compat_uptr_t *ptr, struct sockaddr __user **save_addr);
compat_size_t *len);
int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *, int get_compat_msghdr(struct msghdr *, struct compat_msghdr __user *,
struct sockaddr __user **, struct iovec **); struct sockaddr __user **, struct iovec **);
int put_cmsg_compat(struct msghdr*, int, int, int, void *); int put_cmsg_compat(struct msghdr*, int, int, int, void *);

17
io_uring/net.c
View File

@ -369,24 +369,25 @@ static int __io_compat_recvmsg_copy_hdr(struct io_kiocb *req,
struct io_async_msghdr *iomsg) struct io_async_msghdr *iomsg)
{ {
struct io_sr_msg *sr = io_kiocb_to_cmd(req); struct io_sr_msg *sr = io_kiocb_to_cmd(req);
struct compat_msghdr msg;
struct compat_iovec __user *uiov; struct compat_iovec __user *uiov;
compat_uptr_t ptr;
compat_size_t len;
int ret; int ret;
ret = __get_compat_msghdr(&iomsg->msg, sr->umsg_compat, &iomsg->uaddr, if (copy_from_user(&msg, sr->umsg_compat, sizeof(msg)))
&ptr, &len); return -EFAULT;
ret = __get_compat_msghdr(&iomsg->msg, sr->umsg_compat, &iomsg->uaddr);
if (ret) if (ret)
return ret; return ret;
uiov = compat_ptr(ptr); uiov = compat_ptr(msg.msg_iov);
if (req->flags & REQ_F_BUFFER_SELECT) { if (req->flags & REQ_F_BUFFER_SELECT) {
compat_ssize_t clen; compat_ssize_t clen;
if (len == 0) { if (msg.msg_iovlen == 0) {
sr->len = 0; sr->len = 0;
iomsg->free_iov = NULL; iomsg->free_iov = NULL;
} else if (len > 1) { } else if (msg.msg_iovlen > 1) {
return -EINVAL; return -EINVAL;
} else { } else {
if (!access_ok(uiov, sizeof(*uiov))) if (!access_ok(uiov, sizeof(*uiov)))
@ -400,7 +401,7 @@ static int __io_compat_recvmsg_copy_hdr(struct io_kiocb *req,
} }
} else { } else {
iomsg->free_iov = iomsg->fast_iov; iomsg->free_iov = iomsg->fast_iov;
ret = __import_iovec(READ, (struct iovec __user *)uiov, len, ret = __import_iovec(READ, (struct iovec __user *)uiov, msg.msg_iovlen,
UIO_FASTIOV, &iomsg->free_iov, UIO_FASTIOV, &iomsg->free_iov,
&iomsg->msg.msg_iter, true); &iomsg->msg.msg_iter, true);
if (ret < 0) if (ret < 0)

39
net/compat.c
View File

@ -34,20 +34,15 @@
#include <net/compat.h> #include <net/compat.h>
int __get_compat_msghdr(struct msghdr *kmsg, int __get_compat_msghdr(struct msghdr *kmsg,
struct compat_msghdr __user *umsg, struct compat_msghdr *msg,
struct sockaddr __user **save_addr, struct sockaddr __user **save_addr)
compat_uptr_t *ptr, compat_size_t *len)
{ {
struct compat_msghdr msg;
ssize_t err; ssize_t err;
if (copy_from_user(&msg, umsg, sizeof(*umsg))) kmsg->msg_flags = msg->msg_flags;
return -EFAULT; kmsg->msg_namelen = msg->msg_namelen;
kmsg->msg_flags = msg.msg_flags; if (!msg->msg_name)
kmsg->msg_namelen = msg.msg_namelen;
if (!msg.msg_name)
kmsg->msg_namelen = 0; kmsg->msg_namelen = 0;
if (kmsg->msg_namelen < 0) if (kmsg->msg_namelen < 0)
@ -57,15 +52,15 @@ int __get_compat_msghdr(struct msghdr *kmsg,
kmsg->msg_namelen = sizeof(struct sockaddr_storage); kmsg->msg_namelen = sizeof(struct sockaddr_storage);
kmsg->msg_control_is_user = true; kmsg->msg_control_is_user = true;
kmsg->msg_control_user = compat_ptr(msg.msg_control); kmsg->msg_control_user = compat_ptr(msg->msg_control);
kmsg->msg_controllen = msg.msg_controllen; kmsg->msg_controllen = msg->msg_controllen;
if (save_addr) if (save_addr)
*save_addr = compat_ptr(msg.msg_name); *save_addr = compat_ptr(msg->msg_name);
if (msg.msg_name && kmsg->msg_namelen) { if (msg->msg_name && kmsg->msg_namelen) {
if (!save_addr) { if (!save_addr) {
err = move_addr_to_kernel(compat_ptr(msg.msg_name), err = move_addr_to_kernel(compat_ptr(msg->msg_name),
kmsg->msg_namelen, kmsg->msg_namelen,
kmsg->msg_name); kmsg->msg_name);
if (err < 0) if (err < 0)
@ -76,12 +71,10 @@ int __get_compat_msghdr(struct msghdr *kmsg,
kmsg->msg_namelen = 0; kmsg->msg_namelen = 0;
} }
if (msg.msg_iovlen > UIO_MAXIOV) if (msg->msg_iovlen > UIO_MAXIOV)
return -EMSGSIZE; return -EMSGSIZE;
kmsg->msg_iocb = NULL; kmsg->msg_iocb = NULL;
*ptr = msg.msg_iov;
*len = msg.msg_iovlen;
return 0; return 0;
} }
@ -90,15 +83,17 @@ int get_compat_msghdr(struct msghdr *kmsg,
struct sockaddr __user **save_addr, struct sockaddr __user **save_addr,
struct iovec **iov) struct iovec **iov)
{ {
compat_uptr_t ptr; struct compat_msghdr msg;
compat_size_t len;
ssize_t err; ssize_t err;
err = __get_compat_msghdr(kmsg, umsg, save_addr, &ptr, &len); if (copy_from_user(&msg, umsg, sizeof(*umsg)))
return -EFAULT;
err = __get_compat_msghdr(kmsg, umsg, save_addr);
if (err) if (err)
return err; return err;
err = import_iovec(save_addr ? READ : WRITE, compat_ptr(ptr), len, err = import_iovec(save_addr ? READ : WRITE, compat_ptr(msg.msg_iov), msg.msg_iovlen,
UIO_FASTIOV, iov, &kmsg->msg_iter); UIO_FASTIOV, iov, &kmsg->msg_iter);
return err < 0 ? err : 0; return err < 0 ? err : 0;
} }