lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 23 Mar 2022 01:57:41 +0000 From: David Laight <David.Laight@...LAB.COM> To: 'Torin Carey' <torin@...rey.uk>, "netdev@...r.kernel.org" <netdev@...r.kernel.org> CC: "David S. Miller" <davem@...emloft.net>, Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>, David Ahern <dsahern@...nel.org>, Jakub Kicinski <kuba@...nel.org>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org> Subject: RE: [PATCH] udp: change MSG_TRUNC return behaviour for MSG_PEEK in recvmsg From: Torin Carey > Sent: 22 March 2022 19:04 > > Make UDP recvmsg only return the MSG_TRUNC flag if the read does not > copy the tail end of the datagram. Specifically, this targets MSG_PEEK > when we're using a positive peek offset. > > The current behaviour means that if we have a positive peek offset `off` > and we're reading `r` bytes from a datagram of `ulen` length, we respond > with MSG_TRUNC if and only if `r <= ulen - off`. This is odd behaviour > as we return MSG_TRUNC if the user requests exactly `ulen - off` which > has no truncation. > > The behaviour could be corrected in two ways: > > This patch returns MSG_TRUNC only for tail-end truncation and not head > truncation. This is more consistent with recv(2): > > MSG_TRUNC > > indicates that the trailing portion of a datagram was discarded > > because the datagram was larger than the buffer supplied. > although this isn't written with SO_PEEK_OFF in mind. > > The second option is to always return MSG_TRUNC if `off > 0` like the > man-pages socket(7) page states: > > For datagram sockets, if the "peek offset" points to the middle of a > > packet, the data returned will be marked with the MSG_TRUNC flag. > > Signed-off-by: Torin Carey <torin@...rey.uk> > --- > net/ipv4/udp.c | 2 +- > net/ipv6/udp.c | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c > index 319dd7bbfe33..e57740a2c308 100644 > --- a/net/ipv4/udp.c > +++ b/net/ipv4/udp.c > @@ -1855,7 +1855,7 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock, > copied = len; > if (copied > ulen - off) > copied = ulen - off; > - else if (copied < ulen) > + else if (copied < ulen - off) > msg->msg_flags |= MSG_TRUNC; You can remove a test: if (copied >= ulen - off) copied = ulen - off; else msg->msg_flags |= MSG_TRUNC; David > > /* > diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c > index 14a94cddcf0b..d6c0eed94564 100644 > --- a/net/ipv6/udp.c > +++ b/net/ipv6/udp.c > @@ -348,7 +348,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, > copied = len; > if (copied > ulen - off) > copied = ulen - off; > - else if (copied < ulen) > + else if (copied < ulen - off) > msg->msg_flags |= MSG_TRUNC; > > is_udp4 = (skb->protocol == htons(ETH_P_IP)); > -- > 2.34.1 > - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
Powered by blists - more mailing lists