From: Anton Blanchard <anton@samba.org>
Date: Thu, 4 Aug 2011 14:07:39 +0000 (+0000)
Subject: net: Cap number of elements for sendmmsg
X-Git-Tag: firefly_0821_release~7541^2~3006
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=91f620f98412f866b385b16681d5e59b7e62e343;p=firefly-linux-kernel-4.4.55.git

net: Cap number of elements for sendmmsg

commit 98382f419f32d2c12d021943b87dea555677144b upstream.

To limit the amount of time we can spend in sendmmsg, cap the
number of elements to UIO_MAXIOV (currently 1024).

For error handling an application using sendmmsg needs to retry at
the first unsent message, so capping is simpler and requires less
application logic than returning EINVAL.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/net/socket.c b/net/socket.c
index 8d28c6d225d6..e1cf264b4112 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1999,6 +1999,9 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
 	struct compat_mmsghdr __user *compat_entry;
 	struct msghdr msg_sys;
 
+	if (vlen > UIO_MAXIOV)
+		vlen = UIO_MAXIOV;
+
 	datagrams = 0;
 
 	sock = sockfd_lookup_light(fd, &err, &fput_needed);