[PATCH net 1/2] net: check the sendmsg LSM hook for every batched message

[Avi Weiss <thnkslprpt@gmail.com>]

sendmmsg() skips security_socket_sendmsg() when two consecutive
messages have the same explicit destination address. The comparison
does not account for the message size, so a BPF LSM policy that denies
large sends can be bypassed by placing an allowed message first.

Use __sock_sendmsg() for the cached-destination case as well, so that
every message undergoes the LSM check. Keep the remainder of the
address-caching logic unchanged in this minimal correction.

Fixes: 228e548e6020 ("net: Add sendmmsg socket system call")
Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
---
 net/socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/socket.c b/net/socket.c
index 2e3b5737c481..c2a85224ab55 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2709,7 +2709,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys,
 	    used_address->name_len == msg_sys->msg_namelen &&
 	    !memcmp(&used_address->name, msg_sys->msg_name,
 		    used_address->name_len)) {
-		err = sock_sendmsg_nosec(sock, msg_sys);
+		err = __sock_sendmsg(sock, msg_sys);
 		goto out_freectl;
 	}
 	err = __sock_sendmsg(sock, msg_sys);
-- 
2.43.0