net: rework recvmsg handler msg_name and msg_namelen logic

This patch now always passes msg->msg_namelen as 0. recvmsg handlers must
set msg_namelen to the proper size <= sizeof(struct sockaddr_storage)
to return msg_name to the user.

This prevents numerous uninitialized memory leaks we had in the
recvmsg handlers and makes it harder for new code to accidentally leak
uninitialized memory.

Optimize for the case recvfrom is called with NULL as address. We don't
need to copy the address at all, so set it to NULL before invoking the
recvmsg handler. We can do so, because all the recvmsg handlers must
cope with the case a plain read() is called on them. read() also sets
msg_name to NULL.

Also document these changes in include/linux/net.h as suggested by David
Miller.

Changes since RFC:

Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
affect sendto as it would bail out earlier while trying to copy-in the
address. It also more naturally reflects the logic by the callers of
verify_iovec.

With this change in place I could remove "
if (!uaddr || msg_sys->msg_namelen == 0)
	msg->msg_name = NULL
".

This change does not alter the user visible error logic as we ignore
msg_namelen as long as msg_name is NULL.

Also remove two unnecessary curly brackets in ___sys_recvmsg and change
comments to netdev style.

Cc: David Miller <davem@davemloft.net>
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

35 files changed, 67 insertions, 115 deletions

diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
index 0262210cad38..ef5356cd280a 100644
--- a/crypto/algif_hash.c
+++ b/crypto/algif_hash.c
@@ -161,8 +161,6 @@ static int hash_recvmsg(struct kiocb *unused, struct socket *sock,
         else if (len < ds)
                 msg->msg_flags |= MSG_TRUNC;
 
-        msg->msg_namelen = 0;
-
         lock_sock(sk);
         if (ctx->more) {
                 ctx->more = 0;
diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index a1c4f0a55583..6a6dfc062d2a 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@ -432,7 +432,6 @@ static int skcipher_recvmsg(struct kiocb *unused, struct socket *sock,
         long copied = 0;
 
         lock_sock(sk);
-        msg->msg_namelen = 0;
         for (iov = msg->msg_iov, iovlen = msg->msg_iovlen; iovlen > 0;
              iovlen--, iov++) {
                 unsigned long seglen = iov->iov_len;
diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
index e47dcb9d1e91..5cefb479c707 100644
--- a/drivers/isdn/mISDN/socket.c
+++ b/drivers/isdn/mISDN/socket.c
@@ -117,7 +117,6 @@ mISDN_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 {
         struct sk_buff          *skb;
         struct sock             *sk = sock->sk;
-        struct sockaddr_mISDN   *maddr;
 
         int             copied, err;
 
@@ -135,9 +134,9 @@ mISDN_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (!skb)
                 return err;
 
-        if (msg->msg_namelen >= sizeof(struct sockaddr_mISDN)) {
-                msg->msg_namelen = sizeof(struct sockaddr_mISDN);
-                maddr = (struct sockaddr_mISDN *)msg->msg_name;
+        if (msg->msg_name) {
+                struct sockaddr_mISDN *maddr = msg->msg_name;
+
                 maddr->family = AF_ISDN;
                 maddr->dev = _pms(sk)->dev->id;
                 if ((sk->sk_protocol == ISDN_P_LAPD_TE) ||
@@ -150,11 +149,7 @@ mISDN_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                         maddr->sapi = _pms(sk)->ch.addr & 0xFF;
                         maddr->tei =  (_pms(sk)->ch.addr >> 8) & 0xFF;
                 }
-        } else {
-                if (msg->msg_namelen)
-                        printk(KERN_WARNING "%s: too small namelen %d\n",
-                               __func__, msg->msg_namelen);
-                msg->msg_namelen = 0;
+                msg->msg_namelen = sizeof(*maddr);
         }
 
         copied = skb->len + MISDN_HEADER_LEN;
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 5f66e30d9823..82ee6ed954cb 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -979,8 +979,6 @@ static int pppoe_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (error < 0)
                 goto end;
 
-        m->msg_namelen = 0;
-
         if (skb) {
                 total_len = min_t(size_t, total_len, skb->len);
                 error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
diff --git a/include/linux/net.h b/include/linux/net.h
index b292a0435571..4bcee94cef93 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -164,6 +164,14 @@ struct proto_ops {
 #endif
         int             (*sendmsg)   (struct kiocb *iocb, struct socket *sock,
                                       struct msghdr *m, size_t total_len);
+        /* Notes for implementing recvmsg:
+         * ===============================
+         * msg->msg_namelen should get updated by the recvmsg handlers
+         * iff msg_name != NULL. It is by default 0 to prevent
+         * returning uninitialized memory to user space.  The recvfrom
+         * handlers can assume that msg.msg_name is either NULL or has
+         * a minimum size of sizeof(struct sockaddr_storage).
+         */
         int             (*recvmsg)   (struct kiocb *iocb, struct socket *sock,
                                       struct msghdr *m, size_t total_len,
                                       int flags);
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 7fee50d637f9..7d424ac6e760 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1735,7 +1735,6 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
                          size_t size, int flags)
 {
         struct sock *sk = sock->sk;
-        struct sockaddr_at *sat = (struct sockaddr_at *)msg->msg_name;
         struct ddpehdr *ddp;
         int copied = 0;
         int offset = 0;
@@ -1764,14 +1763,13 @@ static int atalk_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
         }
         err = skb_copy_datagram_iovec(skb, offset, msg->msg_iov, copied);
 
-        if (!err) {
-                if (sat) {
-                        sat->sat_family      = AF_APPLETALK;
-                        sat->sat_port        = ddp->deh_sport;
-                        sat->sat_addr.s_node = ddp->deh_snode;
-                        sat->sat_addr.s_net  = ddp->deh_snet;
-                }
-                msg->msg_namelen = sizeof(*sat);
+        if (!err && msg->msg_name) {
+                struct sockaddr_at *sat = msg->msg_name;
+                sat->sat_family      = AF_APPLETALK;
+                sat->sat_port        = ddp->deh_sport;
+                sat->sat_addr.s_node = ddp->deh_snode;
+                sat->sat_addr.s_net  = ddp->deh_snet;
+                msg->msg_namelen     = sizeof(*sat);
         }