summaryrefslogtreecommitdiffstats
path: root/io_uring
diff options
context:
space:
mode:
authorDylan Yudaken <dylany@fb.com>2022-07-14 13:02:57 +0200
committerJens Axboe <axboe@kernel.dk>2022-07-25 02:39:17 +0200
commit72c531f8ef3052c682d39dc21dcb5576afda208c (patch)
treefa5f25b57b6ac98b2af9048f4e604d6547d27f37 /io_uring
parentnet: copy from user before calling __copy_msghdr (diff)
downloadlinux-72c531f8ef3052c682d39dc21dcb5576afda208c.tar.xz
linux-72c531f8ef3052c682d39dc21dcb5576afda208c.zip
net: copy from user before calling __get_compat_msghdr
this is in preparation for multishot receive from io_uring, where it needs to have access to the original struct user_msghdr. functionally this should be a no-op. Acked-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Dylan Yudaken <dylany@fb.com> Link: https://lore.kernel.org/r/20220714110258.1336200-3-dylany@fb.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring')
-rw-r--r--io_uring/net.c17
1 files changed, 9 insertions, 8 deletions
diff --git a/io_uring/net.c b/io_uring/net.c
index da7667ed3610..5bc3440a8290 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -369,24 +369,25 @@ static int __io_compat_recvmsg_copy_hdr(struct io_kiocb *req,
struct io_async_msghdr *iomsg)
{
struct io_sr_msg *sr = io_kiocb_to_cmd(req);
+ struct compat_msghdr msg;
struct compat_iovec __user *uiov;
- compat_uptr_t ptr;
- compat_size_t len;
int ret;
- ret = __get_compat_msghdr(&iomsg->msg, sr->umsg_compat, &iomsg->uaddr,
- &ptr, &len);
+ if (copy_from_user(&msg, sr->umsg_compat, sizeof(msg)))
+ return -EFAULT;
+
+ ret = __get_compat_msghdr(&iomsg->msg, sr->umsg_compat, &iomsg->uaddr);
if (ret)
return ret;
- uiov = compat_ptr(ptr);
+ uiov = compat_ptr(msg.msg_iov);
if (req->flags & REQ_F_BUFFER_SELECT) {
compat_ssize_t clen;
- if (len == 0) {
+ if (msg.msg_iovlen == 0) {
sr->len = 0;
iomsg->free_iov = NULL;
- } else if (len > 1) {
+ } else if (msg.msg_iovlen > 1) {
return -EINVAL;
} else {
if (!access_ok(uiov, sizeof(*uiov)))
@@ -400,7 +401,7 @@ static int __io_compat_recvmsg_copy_hdr(struct io_kiocb *req,
}
} else {
iomsg->free_iov = iomsg->fast_iov;
- ret = __import_iovec(READ, (struct iovec __user *)uiov, len,
+ ret = __import_iovec(READ, (struct iovec __user *)uiov, msg.msg_iovlen,
UIO_FASTIOV, &iomsg->free_iov,
&iomsg->msg.msg_iter, true);
if (ret < 0)