Re: [PATCH] linux-user: always translate cmsg when recvmsg

[Laurent Vivier]

Le 28/10/2022 à 10:12, Icenowy Zheng a écrit :
> It's possible that a message contains both normal payload and ancillary
> data in the same message, and even if no ancillary data is available
> this information should be passed to the target, otherwise the target
> cmsghdr will be left uninitialized and the target is going to access
> uninitialized memory if it expects cmsg.
>
> Always call the function that translate cmsg when recvmsg, because that
> function should be empty-cmsg-safe (it creates an empty cmsg in the
> target).
>
> Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
> ---
>   linux-user/syscall.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 8402c1399d..029a4e8b42 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -3346,7 +3346,8 @@ static abi_long do_sendrecvmsg_locked(int fd, struct 
> target_msghdr *msgp,
>               if (fd_trans_host_to_target_data(fd)) {
>                   ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base,
>                                                  MIN(msg.msg_iov->iov_len, 
> len));
> -            } else {
> +            }
> +            if (!is_error(ret)) {
>                   ret = host_to_target_cmsg(msgp, &msg);
>               }
>               if (!is_error(ret)) {

Applied to my linux-user-for-7.2 branch.

Thanks,
Laurent