From nobody Fri Jun 17 19:41:06 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 2D6A185D68B; Fri, 17 Jun 2022 19:41:08 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LPqCl39gbz3j3c; Fri, 17 Jun 2022 19:41:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655494867; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lWqu6HyA5hFSQHPS/lumdbPON4sE1wtu7X5mOtL/w9c=; b=RWEjOd9LkF2pD0MJR4O2iDRaP0tI+BDApgRwnxLdiCVzMlu6/jG0XFG6fhxyJTjiJWqkW0 qepWt1P5QNsCHpmbAGeXUlg6OnFCvAvkkXMp5Rn76FeufMCQVgt0DbH3QFyG3l4VUXzvDl Ns0URh2GeNkzKhxXfU2DC5XBSUqGsaP+Jn6SnjtLU/2tdLGJgSeGSZou/Z1xszs5EzfsnO CAXaTlmmEJV8Kar867EZTdvEBFwr3sprBvkCRfbpESKcT6IeEv0WzUeCgGyqXP3dM5SBlq 96+fQxtqv+BoPiruGUzWV6GlnM3DMRD3h/1JdgIRYA6HD4dZ4367gsWZB70uCQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 8EF27259DC; Fri, 17 Jun 2022 19:41:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 25HJf6YC030035; Fri, 17 Jun 2022 19:41:06 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 25HJf69i030034; Fri, 17 Jun 2022 19:41:06 GMT (envelope-from git) Date: Fri, 17 Jun 2022 19:41:06 GMT Message-Id: <202206171941.25HJf69i030034@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Dmitry Chagin Subject: git: ccdf2cd4237d - stable/13 - linux(4): Check the socket before any others sanity checks List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: dchagin X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: ccdf2cd4237d5b5a3cb951382c576fbf5d68dcdc Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1655494867; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=lWqu6HyA5hFSQHPS/lumdbPON4sE1wtu7X5mOtL/w9c=; b=ZvHSOLGx8jzqgZBzJR6xR3mtSDB9OB/RA7MjgMJH9CFqClrp13qYLAOQYO6/m/j92Wnczc f3g44/iy3ADg60JuoagIFeLhVrEra0LtizWc1ElKybOkx8P/VEzA9QzB51QEyhcpjCkobe P2/SOih6x+qke4OUVTVMqL7bh/GH7PHpwt2sTTPaTh29VsxSBOcjGePD3N+w1B9iGyj2aX AIIL773FQWcZN2jnUy/AbPSRsk7NjG9U5kBdXY0thfGC5t3J4o7lZYjRaviyd/qjgjYya6 XSg540ZTdSJGFmLqOqjMhGjUvXu1OpPvZpSDZFp8+7ayS2GjADvDskQ2Orq85g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1655494867; a=rsa-sha256; cv=none; b=DRQuQI9IDwYrZa9/mHG6OelyffzT04gKF5gbsVERkVaGl2zy/xpK3fb0B1eW19g2VKfbl0 UxoK1yrZyaDKGF52uYrsoGCkjz1O3gto0U+MtdMJWVJ6QIkqPsp5HP6WJ6SgwwyA/xm/pc DiXLIkWffNGnjqGfebSJKgCiYiaEpU8OE7v9KtGubZZeHjdXq7lFslXOzRd1M1aeK3RvsR 09C05ZdXqaU4qXRZAIwBZCGjubu2Qd+7vqVWwYIe6Y93mBe82nmRfvBkcCZSrBg5AggsPP LbU4qE9TTLJkvlRjzhu6sxQ2xucviUg0fGILeDSmGDPhBvpjgDA/+zJmqmgEIw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by dchagin: URL: https://cgit.FreeBSD.org/src/commit/?id=ccdf2cd4237d5b5a3cb951382c576fbf5d68dcdc commit ccdf2cd4237d5b5a3cb951382c576fbf5d68dcdc Author: Dmitry Chagin AuthorDate: 2022-05-28 20:29:12 +0000 Commit: Dmitry Chagin CommitDate: 2022-06-17 19:35:32 +0000 linux(4): Check the socket before any others sanity checks Strictly speaking, this check is performed by the kern_recvit(), but in the Linux emulation layer before calling the kernel we do other sanity checks and conversions from Linux types to the native types. This changes an order of the error returning that is critical for some buggy Linux applications. For recvmmsg() syscall this fixes a panic in case when the user-supplied vlen value is 0, then error is not initialized and garbage passed to the bsd_to_linux_errno(). MFC after: 2 weeks (cherry picked from commit 3a99aac66f8d12386e8382aaf29d2e82e6b5353b) --- sys/compat/linux/linux_socket.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/sys/compat/linux/linux_socket.c b/sys/compat/linux/linux_socket.c index b5ec32835981..8aa425bc14c0 100644 --- a/sys/compat/linux/linux_socket.c +++ b/sys/compat/linux/linux_socket.c @@ -1731,7 +1731,14 @@ int linux_recvmsg(struct thread *td, struct linux_recvmsg_args *args) { struct msghdr bsd_msg; + struct file *fp; + int error; + error = getsock_cap(td, args->s, &cap_recv_rights, + &fp, NULL, NULL); + if (error != 0) + return (error); + fdrop(fp, td); return (linux_recvmsg_common(td, args->s, PTRIN(args->msg), args->flags, &bsd_msg)); } @@ -1742,9 +1749,14 @@ linux_recvmmsg_common(struct thread *td, l_int s, struct l_mmsghdr *msg, { struct msghdr bsd_msg; struct timespec ts; + struct file *fp; l_uint retval; int error, datagrams; + error = getsock_cap(td, s, &cap_recv_rights, + &fp, NULL, NULL); + if (error != 0) + return (error); datagrams = 0; while (datagrams < vlen) { error = linux_recvmsg_common(td, s, &msg->msg_hdr, @@ -1780,6 +1792,7 @@ linux_recvmmsg_common(struct thread *td, l_int s, struct l_mmsghdr *msg, } if (error == 0) td->td_retval[0] = datagrams; + fdrop(fp, td); return (error); }