net: copy from user before calling __copy_msghdr

this is in preparation for multishot receive from io_uring, where it needs
to have access to the original struct user_msghdr.

functionally this should be a no-op.

Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Dylan Yudaken <dylany@fb.com>
Link: https://lore.kernel.org/r/20220714110258.1336200-2-dylany@fb.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/include/linux/socket.h b/include/linux/socket.h
index 17311ad..be24f1c 100644 (file)
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -416,10 +416,9 @@ extern int recvmsg_copy_msghdr(struct msghdr *msg,
                               struct user_msghdr __user *umsg, unsigned flags,
                               struct sockaddr __user **uaddr,
                               struct iovec **iov);
-extern int __copy_msghdr_from_user(struct msghdr *kmsg,
-                                  struct user_msghdr __user *umsg,
-                                  struct sockaddr __user **save_addr,
-                                  struct iovec __user **uiov, size_t *nsegs);
+extern int __copy_msghdr(struct msghdr *kmsg,
+                        struct user_msghdr *umsg,
+                        struct sockaddr __user **save_addr);
 
 /* helpers which do the actual work for syscalls */
 extern int __sys_recvfrom(int fd, void __user *ubuf, size_t size,

diff --git a/io_uring/net.c b/io_uring/net.c
index dc9190e..da7667e 100644 (file)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -329,31 +329,32 @@ static int __io_recvmsg_copy_hdr(struct io_kiocb *req,
                                 struct io_async_msghdr *iomsg)
 {
        struct io_sr_msg *sr = io_kiocb_to_cmd(req);
-       struct iovec __user *uiov;
-       size_t iov_len;
+       struct user_msghdr msg;
        int ret;
 
-       ret = __copy_msghdr_from_user(&iomsg->msg, sr->umsg,
-                                       &iomsg->uaddr, &uiov, &iov_len);
+       if (copy_from_user(&msg, sr->umsg, sizeof(*sr->umsg)))
+               return -EFAULT;
+
+       ret = __copy_msghdr(&iomsg->msg, &msg, &iomsg->uaddr);
        if (ret)
                return ret;
 
        if (req->flags & REQ_F_BUFFER_SELECT) {
-               if (iov_len == 0) {
+               if (msg.msg_iovlen == 0) {
                        sr->len = iomsg->fast_iov[0].iov_len = 0;
                        iomsg->fast_iov[0].iov_base = NULL;
                        iomsg->free_iov = NULL;
-               } else if (iov_len > 1) {
+               } else if (msg.msg_iovlen > 1) {
                        return -EINVAL;
                } else {
-                       if (copy_from_user(iomsg->fast_iov, uiov, sizeof(*uiov)))
+                       if (copy_from_user(iomsg->fast_iov, msg.msg_iov, sizeof(*msg.msg_iov)))
                                return -EFAULT;
                        sr->len = iomsg->fast_iov[0].iov_len;
                        iomsg->free_iov = NULL;
                }
        } else {
                iomsg->free_iov = iomsg->fast_iov;
-               ret = __import_iovec(READ, uiov, iov_len, UIO_FASTIOV,
+               ret = __import_iovec(READ, msg.msg_iov, msg.msg_iovlen, UIO_FASTIOV,
                                     &iomsg->free_iov, &iomsg->msg.msg_iter,
                                     false);
                if (ret > 0)

diff --git a/net/socket.c b/net/socket.c
index 96300cd..843545c 100644 (file)
--- a/net/socket.c
+++ b/net/socket.c
@@ -2358,25 +2358,20 @@ struct used_address {
        unsigned int name_len;
 };
 
-int __copy_msghdr_from_user(struct msghdr *kmsg,
-                           struct user_msghdr __user *umsg,
-                           struct sockaddr __user **save_addr,
-                           struct iovec __user **uiov, size_t *nsegs)
+int __copy_msghdr(struct msghdr *kmsg,
+                 struct user_msghdr *msg,
+                 struct sockaddr __user **save_addr)
 {
-       struct user_msghdr msg;
        ssize_t err;
 
-       if (copy_from_user(&msg, umsg, sizeof(*umsg)))
-               return -EFAULT;
-
        kmsg->msg_control_is_user = true;
        kmsg->msg_get_inq = 0;
-       kmsg->msg_control_user = msg.msg_control;
-       kmsg->msg_controllen = msg.msg_controllen;
-       kmsg->msg_flags = msg.msg_flags;
+       kmsg->msg_control_user = msg->msg_control;
+       kmsg->msg_controllen = msg->msg_controllen;
+       kmsg->msg_flags = msg->msg_flags;
 
-       kmsg->msg_namelen = msg.msg_namelen;
-       if (!msg.msg_name)
+       kmsg->msg_namelen = msg->msg_namelen;
+       if (!msg->msg_name)
                kmsg->msg_namelen = 0;
 
        if (kmsg->msg_namelen < 0)
@@ -2386,11 +2381,11 @@ int __copy_msghdr_from_user(struct msghdr *kmsg,
                kmsg->msg_namelen = sizeof(struct sockaddr_storage);
 
        if (save_addr)
-               *save_addr = msg.msg_name;
+               *save_addr = msg->msg_name;
 
-       if (msg.msg_name && kmsg->msg_namelen) {
+       if (msg->msg_name && kmsg->msg_namelen) {
                if (!save_addr) {
-                       err = move_addr_to_kernel(msg.msg_name,
+                       err = move_addr_to_kernel(msg->msg_name,
                                                  kmsg->msg_namelen,
                                                  kmsg->msg_name);
                        if (err < 0)
@@ -2401,12 +2396,10 @@ int __copy_msghdr_from_user(struct msghdr *kmsg,
                kmsg->msg_namelen = 0;
        }
 
-       if (msg.msg_iovlen > UIO_MAXIOV)
+       if (msg->msg_iovlen > UIO_MAXIOV)
                return -EMSGSIZE;
 
        kmsg->msg_iocb = NULL;
-       *uiov = msg.msg_iov;
-       *nsegs = msg.msg_iovlen;
        return 0;
 }
 
@@ -2418,8 +2411,10 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
        struct user_msghdr msg;
        ssize_t err;
 
-       err = __copy_msghdr_from_user(kmsg, umsg, save_addr, &msg.msg_iov,
-                                       &msg.msg_iovlen);
+       if (copy_from_user(&msg, umsg, sizeof(*umsg)))
+               return -EFAULT;
+
+       err = __copy_msghdr(kmsg, &msg, save_addr);
        if (err)
                return err;