Bug 230274 - linuxulator and cloudabi don't handle multiple mbufs in a control message chain
Summary: linuxulator and cloudabi don't handle multiple mbufs in a control message chain
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Dmitry Chagin
URL:
Keywords:
Depends on:
Blocks: 247219
  Show dependency treegraph
 
Reported: 2018-08-01 23:21 UTC by Mark Johnston
Modified: 2022-06-17 19:54 UTC (History)
4 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Johnston freebsd_committer freebsd_triage 2018-08-01 23:21:54 UTC
cloudabi_sock_recv() and linux_recvmsg_common() use kern_recvit(), which may return control messages in addition to data.  Suppose one uses sendmsg() to transmit multiple SCM_RIGHTS messages in a single call.  When these messages are externalized, the unix socket code will place them in separate mbufs which get returned as a chain from kern_recvit().  From code inspection, some consumers only handle the first mbuf in the chain, so control messages will be dropped in some cases.
Comment 1 Alexander Leidinger freebsd_committer freebsd_triage 2020-07-01 07:41:05 UTC
Hi,

Is there somewhere an example of what needs to be done for a person without much knowledge about the network code, but interest to get one or both of the emulation areas fixed?

Bye,
Alexander.
Comment 2 Mark Johnston freebsd_committer freebsd_triage 2020-07-01 16:47:36 UTC
(In reply to Alexander Leidinger from comment #1)
You might compare handling of the "controlp == NULL" case in kern_recvit() with the handling of the "control != NULL" case in linux_recvmsg_common().  The former iterates over all mbufs in the chain, the latter does not.
Comment 3 commit-hook freebsd_committer freebsd_triage 2022-05-28 20:53:46 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=3735f9cff1e8a7ce7079b957bc3b37f0f886caed

commit 3735f9cff1e8a7ce7079b957bc3b37f0f886caed
Author:     Dmitry Chagin <dchagin@FreeBSD.org>
AuthorDate: 2022-05-28 20:48:45 +0000
Commit:     Dmitry Chagin <dchagin@FreeBSD.org>
CommitDate: 2022-05-28 20:48:45 +0000

    linux(4): Handle multiple mbufs in a control message chain in recvmsg

    PR:             230274
    MFC after:      2 weeks

 sys/compat/linux/linux_socket.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
Comment 4 commit-hook freebsd_committer freebsd_triage 2022-06-17 19:42:17 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=82062a044383ecb402a1f003249359616a660390

commit 82062a044383ecb402a1f003249359616a660390
Author:     Dmitry Chagin <dchagin@FreeBSD.org>
AuthorDate: 2022-05-28 20:48:45 +0000
Commit:     Dmitry Chagin <dchagin@FreeBSD.org>
CommitDate: 2022-06-17 19:35:37 +0000

    linux(4): Handle multiple mbufs in a control message chain in recvmsg

    PR:             230274
    MFC after:      2 weeks

    (cherry picked from commit 3735f9cff1e8a7ce7079b957bc3b37f0f886caed)

 sys/compat/linux/linux_socket.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)