Re: sys_sendmsg Fails Silently With Negative msg_namelen

[Matthew Leach <matthew.leach@arm.com>]

Hi Dan,

Dan Carpenter <dan.carpenter@oracle.com> writes:

[...]

> I think Ruby was using larger buffer sizes than necessary so we could
> add something like:
>
> 	if (kmsg->msg_namelen < 0)
> 		return -EINVAL;
> 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
>   		kmsg->msg_namelen = sizeof(struct sockaddr_storage);

I don't see how your patch does anything different?  If we don't clamp
the value and leave it as -1 the check for a negative buffer size
eventually happens in move_addr_to_kernel anyway, just before we copy
the buffer from userspace.  This check fails and returns EINVAL.

>
>
> Why are people passing -1 as the buffer size anyway?  

This was actually found with LTP.  The sendmsg01 test passes -1 as the
msg_namelen parameter and expects the syscall to fail.

> Your email suggests that people expect it to work, and it will work
> fine if you have a buffer size which is larger than sizeof(struct
> sockaddr_storage).  I'm nervous about changing something which works
> fine in case I break userspace.  A second time.  :P

Agreed, but IMHO passing -1 as a buffer size should cause a syscall to
fail, rather than assuming we can copy from the buffer.

-- 
Matt