Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1157360

[PATCH 3.10 07/46] net: socket: Fix the wrong returns for recvmsg and sendmsg

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Junling Zheng <zhengjunling@huawei.com>

Based on 08adb7dabd4874cc5666b4490653b26534702ce0 upstream.

We found that after v3.10.73, recvmsg might return -EFAULT while -EINVAL
was expected.

We tested it through the recvmsg01 testcase come from LTP testsuit. It set
msg->msg_namelen to -1 and the recvmsg syscall returned errno 14, which is
unexpected (errno 22 is expected):

recvmsg01    4  TFAIL  :  invalid socket length ; returned -1 (expected -1),
errno 14 (expected 22)

Linux mainline has no this bug for commit 08adb7dab fixes it accidentally.
However, it is too large and complex to be backported to LTS 3.10.

Commit 281c9c36 (net: compat: Update get_compat_msghdr() to match
copy_msghdr_from_user() behaviour) made get_compat_msghdr() return
error if msg_sys->msg_namelen was negative, which changed the behaviors
of recvmsg and sendmsg syscall in a lib32 system:

Before commit 281c9c36, get_compat_msghdr() wouldn't fail and it would
return -EINVAL in move_addr_to_user() or somewhere if msg_sys->msg_namelen
was invalid and then syscall returned -EINVAL, which is correct.

And now, when msg_sys->msg_namelen is negative, get_compat_msghdr() will
fail and wants to return -EINVAL, however, the outer syscall will return
-EFAULT directly, which is unexpected.

This patch gets the return value of get_compat_msghdr() as well as
copy_msghdr_from_user(), then returns this expected value if
get_compat_msghdr() fails.

Fixes: 281c9c36 (net: compat: Update get_compat_msghdr() to match copy_msghdr_from_user() behaviour)
Signed-off-by: Junling Zheng <zhengjunling@huawei.com>
Signed-off-by: Hanbing Xu <xuhanbing@huawei.com>
Cc: Li Zefan <lizefan@huawei.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/socket.c |   24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

--- a/net/socket.c
+++ b/net/socket.c
@@ -1988,14 +1988,12 @@ static int ___sys_sendmsg(struct socket
 	int err, ctl_len, total_len;
 
 	err = -EFAULT;
-	if (MSG_CMSG_COMPAT & flags) {
-		if (get_compat_msghdr(msg_sys, msg_compat))
-			return -EFAULT;
-	} else {
+	if (MSG_CMSG_COMPAT & flags)
+		err = get_compat_msghdr(msg_sys, msg_compat);
+	else
 		err = copy_msghdr_from_user(msg_sys, msg);
-		if (err)
-			return err;
-	}
+	if (err)
+		return err;
 
 	if (msg_sys->msg_iovlen > UIO_FASTIOV) {
 		err = -EMSGSIZE;
@@ -2200,14 +2198,12 @@ static int ___sys_recvmsg(struct socket
 	struct sockaddr __user *uaddr;
 	int __user *uaddr_len;
 
-	if (MSG_CMSG_COMPAT & flags) {
-		if (get_compat_msghdr(msg_sys, msg_compat))
-			return -EFAULT;
-	} else {
+	if (MSG_CMSG_COMPAT & flags)
+		err = get_compat_msghdr(msg_sys, msg_compat);
+	else
 		err = copy_msghdr_from_user(msg_sys, msg);
-		if (err)
-			return err;
-	}
+	if (err)
+		return err;
 
 	if (msg_sys->msg_iovlen > UIO_FASTIOV) {
 		err = -EMSGSIZE;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/46] 3.10.80-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 07/46] net: socket: Fix the wrong returns for recvmsg and sendmsg Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 42/46] rtlwifi: rtl8192cu: Fix kernel deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 36/46] rt2x00: add new rt2800usb device DWA 130 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 44/46] ACPI / init: Fix the ordering of acpi_reserve_resources() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 11/46] libceph: request a new osdmap if lingering request maps to no osd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 19/46] ASoC: wm8960: fix "RINPUT3" audio route error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 23/46] xhci: Solve full event ring by increasing TRBS_PER_SEGMENT to 256 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 22/46] xhci: fix isoc endpoint dequeue from advancing too far on transaction error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 10/46] lguest: fix out-by-one error in address checking. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 31/46] mmc: atmel-mci: fix bad variable type for clkdiv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 12/46] hwmon: (ntc_thermistor) Ensure iio channel is of type IIO_VOLTAGE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 09/46] fs, omfs: add NULL terminator in the end up the token list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 15/46] ALSA: hda - Add Conexant codecs CX20721, CX20722, CX20723 and CX20724 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 16/46] ALSA: hda - Add headphone quirk for Lifebook E752 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 14/46] d_walk() might skip too much Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 43/46] Input: elantech - fix semi-mt protocol for v3 HW Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 46/46] fs/binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 24/46] xhci: gracefully handle xhci_irq dead device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 01/46] staging: wlags49_h2: fix extern inline functions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 37/46] crypto: s390/ghash - Fix incorrect ghash icv buffer handling. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 08/46] KVM: MMU: fix CR4.SMEP=1, CR0.WP=0 with shadow pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 45/46] vfs: read file_handle only once in handle_to_path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 06/46] kernel: use the gnu89 standard explicitly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 18/46] ASoC: uda1380: Avoid accessing i2c bus when codec is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 13:50 +0200
  [PATCH 3.10 34/46] libata: Add helper to determine when PHY events should be ignored Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 25/46] USB: visor: Match I330 phone more precisely Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 20/46] ASoC: wm8994: correct BCLK DIV 348 to 384 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 04/46] staging: rtl8712, rtl8712: avoid lots of build warnings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 32/46] ext4: convert write_begin methods to stable_page_writes semantics Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 30/46] powerpc: Align TOC to 256 bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 13/46] lib: Fix strnlen_user() to not touch memory after specified maximum Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 39/46] ARM: fix missing syscall trace exit Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 05/46] staging, rtl8192e, LLVMLinux: Remove unused inline prototype Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 03/46] staging, rtl8192e, LLVMLinux: Change extern inline to static inline Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 17/46] ASoC: mc13783: Fix wrong mask value used in mc13xxx_reg_rmw() calls Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 41/46] md/raid5: dont record new size if resize_stripes fails. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 26/46] USB: pl2303: Remove support for Samsung I330 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 29/46] usb: gadget: configfs: Fix interfaces array NULL-termination Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 33/46] ext4: check for zero length extent explicitly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 40/46] svcrpc: fix potential GSSX_ACCEPT_SEC_CONTEXT decoding failures Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  [PATCH 3.10 27/46] USB: cp210x: add ID for KCF Technologies PRN device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-06-03 14:00 +0200
  Re: [PATCH 3.10 00/46] 3.10.80-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-06-03 19:00 +0200

csiph-web