On Sat, 31 Oct 2026 13:08:40 +0200, Avi Weiss wrote:
sendmmsg() skips security_socket_sendmsg() when two consecutive
messages have the same explicit destination address. The comparison
does not account for the message size, so a BPF LSM policy that denies
large sends can be bypassed by placing an allowed message first.
What is the real use case ?
or is this something just flagged by AI ?
Use __sock_sendmsg() for the cached-destination case as well, so that
every message undergoes the LSM check. Keep the remainder of the
address-caching logic unchanged in this minimal correction.
Fixes: 228e548e6020 ("net: Add sendmmsg socket system call")
This is net-next material.
quoted hunk ↗ jump to hunk
Signed-off-by: Avi Weiss <redacted>
---
net/socket.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/socket.c b/net/socket.c
index 2e3b5737c481..c2a85224ab55 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2709,7 +2709,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
/*
* If this is sendmmsg() and current destination address is same as
* previously succeeded address, omit asking LSM's decision.
* used_address->name_len is initialized to UINT_MAX so that the first
* destination address never matches.
*/
The comment here is stale.
if (used_address && msg_sys->msg_name &&
used_address->name_len == msg_sys->msg_namelen &&
!memcmp(&used_address->name, msg_sys->msg_name,
used_address->name_len)) {
Also, used_address, etc is no longer needed.
- err = sock_sendmsg_nosec(sock, msg_sys);
+ err = __sock_sendmsg(sock, msg_sys);
goto out_freectl;
}
err = __sock_sendmsg(sock, msg_sys);
--
2.43.0