Bug 230274

Summary:	linuxulator and cloudabi don't handle multiple mbufs in a control message chain
Product:	Base System	Reporter:	Mark Johnston <markj>
Component:	kern	Assignee:	Dmitry Chagin <dchagin>
Status:	Closed FIXED
Severity:	Affects Some People	CC:	dchagin, ed, emaste, netchild
Priority:	---
Version:	CURRENT
Hardware:	Any
OS:	Any
Bug Depends on:
Bug Blocks:	247219

Description Mark Johnston freebsd_committer

2018-08-01 23:21:54 UTC

cloudabi_sock_recv() and linux_recvmsg_common() use kern_recvit(), which may return control messages in addition to data.  Suppose one uses sendmsg() to transmit multiple SCM_RIGHTS messages in a single call.  When these messages are externalized, the unix socket code will place them in separate mbufs which get returned as a chain from kern_recvit().  From code inspection, some consumers only handle the first mbuf in the chain, so control messages will be dropped in some cases.

Comment 1 Alexander Leidinger freebsd_committer

2020-07-01 07:41:05 UTC

Hi,

Is there somewhere an example of what needs to be done for a person without much knowledge about the network code, but interest to get one or both of the emulation areas fixed?

Bye,
Alexander.

Comment 2 Mark Johnston freebsd_committer

2020-07-01 16:47:36 UTC

(In reply to Alexander Leidinger from comment #1)
You might compare handling of the "controlp == NULL" case in kern_recvit() with the handling of the "control != NULL" case in linux_recvmsg_common().  The former iterates over all mbufs in the chain, the latter does not.

Comment 3 commit-hook freebsd_committer

2022-05-28 20:53:46 UTC

A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=3735f9cff1e8a7ce7079b957bc3b37f0f886caed

commit 3735f9cff1e8a7ce7079b957bc3b37f0f886caed
Author:     Dmitry Chagin <dchagin@FreeBSD.org>
AuthorDate: 2022-05-28 20:48:45 +0000
Commit:     Dmitry Chagin <dchagin@FreeBSD.org>
CommitDate: 2022-05-28 20:48:45 +0000

    linux(4): Handle multiple mbufs in a control message chain in recvmsg

    PR:             230274
    MFC after:      2 weeks

 sys/compat/linux/linux_socket.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

Comment 4 commit-hook freebsd_committer

2022-06-17 19:42:17 UTC

A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=82062a044383ecb402a1f003249359616a660390

commit 82062a044383ecb402a1f003249359616a660390
Author:     Dmitry Chagin <dchagin@FreeBSD.org>
AuthorDate: 2022-05-28 20:48:45 +0000
Commit:     Dmitry Chagin <dchagin@FreeBSD.org>
CommitDate: 2022-06-17 19:35:37 +0000

    linux(4): Handle multiple mbufs in a control message chain in recvmsg

    PR:             230274
    MFC after:      2 weeks

    (cherry picked from commit 3735f9cff1e8a7ce7079b957bc3b37f0f886caed)

 sys/compat/linux/linux_socket.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)