unix domain sockets bugfix

Hi,

I've found a bug with unix domain sockets in both kernels 2.2 and 2.4. If the program issues a recvfrom() on a SOCK_DGRAM socket, and the sender had no name, the sockaddr returned is not filled in.

The returned socklen is 2, but the sockaddr.family is not touched. A fix is below:

@@ -1392,6 +1392,9 @@
 		       sk->protinfo.af_unix.addr->name,
 		       sk->protinfo.af_unix.addr->len);
 	}
+	else {
+		((struct sockaddr *) msg->msg_name)->sa_family = AF_UNIX;
+	}
 }
 
 static int unix_dgram_recvmsg(struct socket *sock, struct msghdr *msg, int size,

Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

From: Balazs Scheidler <[email protected]>
Date: Mon, 7 Oct 2002 09:35:32 +0200

The returned socklen is 2, but the sockaddr.family is not touched. A fix is below:

Since msg->msg_namelen is zero, msg->msg_name should not be interpreted in any way at all.

You would be right, if it would be zero, but it isn't:

373 res = recvfrom(closure->fd, buffer, length, 0, (struct sockaddr *) addr, (socklen_t *) addrlen);
(gdb) n
375 if (*addrlen == 2) {
(gdb) p *addrlen
$2 = 2

Checking out the code again:

static void unix_copy_addr(struct msghdr *msg, struct sock *sk)

{
        msg->msg_namelen = sizeof(short);
        if (sk->protinfo.af_unix.addr) {
                msg->msg_namelen=sk->protinfo.af_unix.addr->len;
                memcpy(msg->msg_name,
                       sk->protinfo.af_unix.addr->name,
                       sk->protinfo.af_unix.addr->len);
        }
}

namelen is explicitly set to sizeof(short) == 2.

This is 2.4.18

Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

From: Balazs Scheidler <[email protected]>
Date: Mon, 7 Oct 2002 10:01:01 +0200

This is 2.4.18

Look at current 2.4.20-preX sources, it is set to zero now.

This is not an issue for 2.2, as msg->msg_namelen is already zeroed appropriately.

- James

James Morris
<[email protected]>