Commit 98543980 authored by Jan Kiszka's avatar Jan Kiszka
Browse files

drivers/net: udp, packet: Respect msg_namelen when filling msg_name



We must not write more than what was allocated and reported via
msg_namelen by userspace. We may truncate, though, then reporting what
would have been written if there had been enough space.
Signed-off-by: Jan Kiszka's avatarJan Kiszka <jan.kiszka@siemens.com>
parent 1ee4f1a2
......@@ -441,12 +441,18 @@ ssize_t rt_udp_recvmsg(struct rtdm_fd *fd, struct user_msghdr *msg,
sin.sin_family = AF_INET;
sin.sin_port = uh->source;
sin.sin_addr.s_addr = skb->nh.iph->saddr;
ret = rtnet_put_arg(fd, msg->msg_name, &sin, sizeof(sin));
if (msg->msg_namelen < 0) {
ret = -EINVAL;
goto fail;
}
namelen = min(sizeof(sin), (size_t)msg->msg_namelen);
ret = rtnet_put_arg(fd, msg->msg_name, &sin, namelen);
if (ret)
goto fail;
namelen = sizeof(sin);
msg->msg_namelen = namelen;
msg->msg_namelen = sizeof(sin);
}
data_len = ntohs(uh->len) - sizeof(struct udphdr);
......
......@@ -347,15 +347,20 @@ static ssize_t rt_packet_recvmsg(struct rtdm_fd *fd, struct user_msghdr *msg,
sll.sll_pkttype = rtskb->pkt_type;
sll.sll_ifindex = rtdev->ifindex;
if (msg->msg_namelen < 0) {
ret = -EINVAL;
goto fail;
}
namelen = min(sizeof(sll), (size_t)msg->msg_namelen);
/* Ethernet specific - we rather need some parse handler here */
memcpy(sll.sll_addr, rtskb->mac.ethernet->h_source, ETH_ALEN);
sll.sll_halen = ETH_ALEN;
ret = rtnet_put_arg(fd, msg->msg_name, &sll, sizeof(sll));
ret = rtnet_put_arg(fd, msg->msg_name, &sll, namelen);
if (ret)
goto fail;
namelen = sizeof(sll);
msg->msg_namelen = namelen;
msg->msg_namelen = sizeof(sll);
}
/* Include the header in raw delivery */
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment