netdev - Re: [RFC] Zero-length write() does not generate a datagram on connected socket

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 27 Sep 2007 15:41:44 -0700
From:	Stephen Hemminger <shemminger@...ux-foundation.org>
To:	David Miller <davem@...emloft.net>
Cc:	netdev@...r.kernel.org
Subject: Re: [RFC] Zero-length write() does not generate a datagram on
 connected socket

On Thu, 27 Sep 2007 13:53:34 -0700 (PDT)
David Miller <davem@...emloft.net> wrote:

> From: Stephen Hemminger <shemminger@...ux-foundation.org>
> Date: Mon, 24 Sep 2007 15:34:35 -0700
> 
> > The bug http://bugzilla.kernel.org/show_bug.cgi?id=5731
> > describes an issue where write() can't be used to generate a zero-length
> > datagram (but send, and sendto do work).
> > 
> > I think the following is needed:
> > 
> > --- a/net/socket.c	2007-08-20 09:54:28.000000000 -0700
> > +++ b/net/socket.c	2007-09-24 15:31:25.000000000 -0700
> > @@ -777,8 +777,11 @@ static ssize_t sock_aio_write(struct kio
> >  	if (pos != 0)
> >  		return -ESPIPE;
> >  
> > -	if (iocb->ki_left == 0)	/* Match SYS5 behaviour */
> > -		return 0;
> > +	if (unlikely(iocb->ki_left == 0)) {
> > +		struct socket *sock = iocb->ki_filp->private_data;
> > +		if (sock->type == SOCK_STREAM)
> > +			return 0;
> > +	}
> >  
> >  	x = alloc_sock_iocb(iocb, &siocb);
> >  	if (!x)
> 
> We should simply remove the check completely.
> 
> There is no need to add special code for different types of protocols
> and sockets.
> 
> As is hinted in the bugzilla, the exact same thing can happen with a
> suitably constructed sendto() or sendmsg() call.  write() on a socket
> is a sendmsg() with a NULL msg_control and a single entry iovec, plain
> and simple.
> 
> It's how BSD and many other systems behave, and I double checked
> Steven's Volume 2 just to make sure.
> 
> So I'm going to check in the following to fix this bugzilla.  There is
> a similarly ugly test for len==0 in sys_read() on sockets.  If someone
> would do some research on the validity of that thing I'd really
> appreciate it :-)

Read of zero length should be a no-op for SOCK_STREAM but
for SOCK_DATAGRAM or SOCK_SEQPACKET it might be useful as a 
remote wait for event.

-- 
Stephen Hemminger <shemminger@...ux-foundation.org>
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html