[PATCH net 1/2] net: check the sendmsg LSM hook for every batched message

[PATCH net 1/2] net: check the sendmsg LSM hook for every batched message

[Avi Weiss]

sendmmsg() skips security_socket_sendmsg() when two consecutive
messages have the same explicit destination address. The comparison
does not account for the message size, so a BPF LSM policy that denies
large sends can be bypassed by placing an allowed message first.

Use __sock_sendmsg() for the cached-destination case as well, so that
every message undergoes the LSM check. Keep the remainder of the
address-caching logic unchanged in this minimal correction.

Fixes: 228e548e6020 ("net: Add sendmmsg socket system call")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 net/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/socket.c b/net/socket.c
index 2e3b5737c481..c2a85224ab55 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2709,7 +2709,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
 	    used_address->name_len == msg_sys->msg_namelen &&
 	    !memcmp(&used_address->name, msg_sys->msg_name,
 		    used_address->name_len)) {
-		err = sock_sendmsg_nosec(sock, msg_sys);
+		err = __sock_sendmsg(sock, msg_sys);
 		goto out_freectl;
 	}
 	err = __sock_sendmsg(sock, msg_sys);
-- 
2.43.0

[PATCH net 2/2] net: check the recvmsg LSM hook for every recvmmsg entry

[Avi Weiss]

do_recvmmsg() passes the number of received datagrams as the nosec
argument to ___sys_recvmsg(). After the first datagram, this bypasses
security_socket_recvmsg() even when a later entry requests a larger
receive buffer that would be rejected by an LSM policy.

Pass zero for both native and compat entries so each receive goes
through the security check. Remove the first-datagram-only comment.

Fixes: a2e2725541fa ("net: Introduce recvmmsg socket syscall")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 net/socket.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/net/socket.c b/net/socket.c
index c2a85224ab55..fff80fbca1a8 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -3057,13 +3057,10 @@ static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
 	compat_entry = (struct compat_mmsghdr __user *)mmsg;
 
 	while (datagrams < vlen) {
-		/*
-		 * No need to ask LSM for more than the first datagram.
-		 */
 		if (MSG_CMSG_COMPAT & flags) {
 			err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
 					     &msg_sys, flags & ~MSG_WAITFORONE,
-					     datagrams);
+					     0);
 			if (err < 0)
 				break;
 			err = put_user(err, &compat_entry->msg_len);
@@ -3072,7 +3069,7 @@ static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
 			err = ___sys_recvmsg(sock,
 					     (struct user_msghdr __user *)entry,
 					     &msg_sys, flags & ~MSG_WAITFORONE,
-					     datagrams);
+					     0);
 			if (err < 0)
 				break;
 			err = put_user(err, &entry->msg_len);
-- 
2.43.0

Re: [PATCH net 2/2] net: check the recvmsg LSM hook for every recvmmsg entry

[Kuniyuki Iwashima]

On Sat, 31 Oct 2026 13:08:41 +0200, Avi Weiss wrote:
> do_recvmmsg() passes the number of received datagrams as the nosec
> argument to ___sys_recvmsg(). After the first datagram, this bypasses
> security_socket_recvmsg() even when a later entry requests a larger
> receive buffer that would be rejected by an LSM policy.

Same question, what is the real use case ?

> 
> Pass zero for both native and compat entries so each receive goes
> through the security check. Remove the first-datagram-only comment.
> 
> Fixes: a2e2725541fa ("net: Introduce recvmmsg socket syscall")

Remove this.


> Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
> ---
>  net/socket.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/net/socket.c b/net/socket.c
> index c2a85224ab55..fff80fbca1a8 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -3057,13 +3057,10 @@ static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
>  	compat_entry = (struct compat_mmsghdr __user *)mmsg;
>  
>  	while (datagrams < vlen) {
> -		/*
> -		 * No need to ask LSM for more than the first datagram.
> -		 */
>  		if (MSG_CMSG_COMPAT & flags) {
>  			err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
>  					     &msg_sys, flags & ~MSG_WAITFORONE,
> -					     datagrams);
> +					     0);
>  			if (err < 0)
>  				break;
>  			err = put_user(err, &compat_entry->msg_len);
> @@ -3072,7 +3069,7 @@ static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
>  			err = ___sys_recvmsg(sock,
>  					     (struct user_msghdr __user *)entry,
>  					     &msg_sys, flags & ~MSG_WAITFORONE,
> -					     datagrams);
> +					     0);

This makes nosec dead in every path.

---
pw-bot: cr


>  			if (err < 0)
>  				break;
>  			err = put_user(err, &entry->msg_len);
> -- 
> 2.43.0
> 

Re: [PATCH net 1/2] net: check the sendmsg LSM hook for every batched message

[Kuniyuki Iwashima]

On Sat, 31 Oct 2026 13:08:40 +0200, Avi Weiss wrote:
> sendmmsg() skips security_socket_sendmsg() when two consecutive
> messages have the same explicit destination address. The comparison
> does not account for the message size, so a BPF LSM policy that denies
> large sends can be bypassed by placing an allowed message first.

What is the real use case ?

or is this something just flagged by AI ?


> 
> Use __sock_sendmsg() for the cached-destination case as well, so that
> every message undergoes the LSM check. Keep the remainder of the
> address-caching logic unchanged in this minimal correction.
> 
> Fixes: 228e548e6020 ("net: Add sendmmsg socket system call")

This is net-next material.


> Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
> ---
>  net/socket.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/socket.c b/net/socket.c
> index 2e3b5737c481..c2a85224ab55 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -2709,7 +2709,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,

 	/*
 	 * If this is sendmmsg() and current destination address is same as
 	 * previously succeeded address, omit asking LSM's decision.
 	 * used_address->name_len is initialized to UINT_MAX so that the first
 	 * destination address never matches.
 	 */

The comment here is stale.

 	if (used_address && msg_sys->msg_name &&

>  	    used_address->name_len == msg_sys->msg_namelen &&
>  	    !memcmp(&used_address->name, msg_sys->msg_name,
>  		    used_address->name_len)) {

Also, used_address, etc is no longer needed.


> -		err = sock_sendmsg_nosec(sock, msg_sys);
> +		err = __sock_sendmsg(sock, msg_sys);
>  		goto out_freectl;
>  	}
>  	err = __sock_sendmsg(sock, msg_sys);
> -- 
> 2.43.0
>