Patch "net: Save and restore msg_namelen in sock_sendmsg" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: Save and restore msg_namelen in sock_sendmsg

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-save-and-restore-msg_namelen-in-sock_sendmsg.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2331ded635a94a4d4b90106a3784a011039f8620
Author: Marc Dionne <marc.dionne@xxxxxxxxxxxx>
Date:   Thu Dec 21 09:12:30 2023 -0400

    net: Save and restore msg_namelen in sock_sendmsg
    
    [ Upstream commit 01b2885d9415152bcb12ff1f7788f500a74ea0ed ]
    
    Commit 86a7e0b69bd5 ("net: prevent rewrite of msg_name in
    sock_sendmsg()") made sock_sendmsg save the incoming msg_name pointer
    and restore it before returning, to insulate the caller against
    msg_name being changed by the called code.  If the address length
    was also changed however, we may return with an inconsistent structure
    where the length doesn't match the address, and attempts to reuse it may
    lead to lost packets.
    
    For example, a kernel that doesn't have commit 1c5950fc6fe9 ("udp6: fix
    potential access to stale information") will replace a v4 mapped address
    with its ipv4 equivalent, and shorten namelen accordingly from 28 to 16.
    If the caller attempts to reuse the resulting msg structure, it will have
    the original ipv6 (v4 mapped) address but an incorrect v4 length.
    
    Fixes: 86a7e0b69bd5 ("net: prevent rewrite of msg_name in sock_sendmsg()")
    Signed-off-by: Marc Dionne <marc.dionne@xxxxxxxxxxxx>
    Reviewed-by: Willem de Bruijn <willemb@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/socket.c b/net/socket.c
index c4a6f55329552..8d83c4bb163b4 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -757,6 +757,7 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg)
 {
 	struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name;
 	struct sockaddr_storage address;
+	int save_len = msg->msg_namelen;
 	int ret;
 
 	if (msg->msg_name) {
@@ -766,6 +767,7 @@ int sock_sendmsg(struct socket *sock, struct msghdr *msg)
 
 	ret = __sock_sendmsg(sock, msg);
 	msg->msg_name = save_addr;
+	msg->msg_namelen = save_len;
 
 	return ret;
 }