do_recvmmsg() passes the number of received datagrams as the nosec
argument to ___sys_recvmsg(). After the first datagram, this bypasses
security_socket_recvmsg() even when a later entry requests a larger
receive buffer that would be rejected by an LSM policy.
Pass zero for both native and compat entries so each receive goes
through the security check. Remove the first-datagram-only comment.
Fixes: a2e2725541fa ("net: Introduce recvmmsg socket syscall")
Signed-off-by: Avi Weiss <redacted>
---
net/socket.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/net/socket.c b/net/socket.c
index c2a85224ab55..fff80fbca1a8 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -3057,13 +3057,10 @@ static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
compat_entry = (struct compat_mmsghdr __user *)mmsg;
while (datagrams < vlen) {
- /*
- * No need to ask LSM for more than the first datagram.
- */
if (MSG_CMSG_COMPAT & flags) {
err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
&msg_sys, flags & ~MSG_WAITFORONE,
- datagrams);
+ 0);
if (err < 0)
break;
err = put_user(err, &compat_entry->msg_len);@@ -3072,7 +3069,7 @@ static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
err = ___sys_recvmsg(sock,
(struct user_msghdr __user *)entry,
&msg_sys, flags & ~MSG_WAITFORONE,
- datagrams);
+ 0);
if (err < 0)
break;
err = put_user(err, &entry->msg_len);
--
2.43.0