Re: [PATCH] net: Save and restore msg_namelen in sock_sendmsg

[Willem de Bruijn]

Marc Dionne wrote:
> Commit 86a7e0b69bd5 ("net: prevent rewrite of msg_name in
> sock_sendmsg()") made sock_sendmsg save the incoming msg_name pointer
> and restore it before returning, to insulate the caller against
> msg_name being changed by the called code.  If the address length
> was also changed however, we may return with an inconsistent structure
> where the length doesn't match the address, and attempts to reuse it may
> lead to lost packets.
> 
> For example, a kernel that doesn't have commit 1c5950fc6fe9 ("udp6: fix
> potential access to stale information") will replace a v4 mapped address
> with its ipv4 equivalent, and shorten namelen accordingly from 28 to 16.
> If the caller attempts to reuse the resulting msg structure, it will have
> the original ipv6 (v4 mapped) address but an incorrect v4 length.
> 
> Fixes: 86a7e0b69bd5 ("net: prevent rewrite of msg_name in sock_sendmsg()")
> Signed-off-by: Marc Dionne <marc.dionne@xxxxxxxxxxxx>

Reviewed-by: Willem de Bruijn <willemb@xxxxxxxxxx>