Received-SPF: pass (google.com: domain of linux-kernel+bounces-15041-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.48.161 as permitted sender) client-ip=147.75.48.161;
Date: Tue, 02 Jan 2024 20:38:56 -0500
From: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
To: Marc Dionne <marc.dionne@auristor.com>, 
 netdev@vger.kernel.org, 
 Jordan Rife <jrife@google.com>, 
 Jakub Kicinski <kuba@kernel.org>, 
 Paolo Abeni <pabeni@redhat.com>, 
 Eric Dumazet <edumazet@google.com>, 
 "David S. Miller" <davem@davemloft.net>
Cc: Willem de Bruijn <willemb@google.com>, 
 Simon Horman <horms@kernel.org>, 
 linux-kernel@vger.kernel.org
Message-ID: <6594bab0a524_2c093829412@willemb.c.googlers.com.notmuch>
In-Reply-To: <20231221131230.2025000-1-marc.dionne@auristor.com>
References: <20231221131230.2025000-1-marc.dionne@auristor.com>
Subject: Re: [PATCH] net: Save and restore msg_namelen in sock_sendmsg
Precedence: bulk
Mime-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: 7bit

Marc Dionne wrote:
> Commit 86a7e0b69bd5 ("net: prevent rewrite of msg_name in
> sock_sendmsg()") made sock_sendmsg save the incoming msg_name pointer
> and restore it before returning, to insulate the caller against
> msg_name being changed by the called code.  If the address length
> was also changed however, we may return with an inconsistent structure
> where the length doesn't match the address, and attempts to reuse it may
> lead to lost packets.
> 
> For example, a kernel that doesn't have commit 1c5950fc6fe9 ("udp6: fix
> potential access to stale information") will replace a v4 mapped address
> with its ipv4 equivalent, and shorten namelen accordingly from 28 to 16.
> If the caller attempts to reuse the resulting msg structure, it will have
> the original ipv6 (v4 mapped) address but an incorrect v4 length.
> 
> Fixes: 86a7e0b69bd5 ("net: prevent rewrite of msg_name in sock_sendmsg()")
> Signed-off-by: Marc Dionne <marc.dionne@auristor.com>

Reviewed-by: Willem de Bruijn <willemb@google.com>