Re: [PATCH net 2/2] net: check the recvmsg LSM hook for every recvmmsg entry

[Kuniyuki Iwashima <kuniyu@google.com>]

On Sat, 31 Oct 2026 13:08:41 +0200, Avi Weiss wrote:
> do_recvmmsg() passes the number of received datagrams as the nosec
> argument to ___sys_recvmsg(). After the first datagram, this bypasses
> security_socket_recvmsg() even when a later entry requests a larger
> receive buffer that would be rejected by an LSM policy.

Same question, what is the real use case ?

> 
> Pass zero for both native and compat entries so each receive goes
> through the security check. Remove the first-datagram-only comment.
> 
> Fixes: a2e2725541fa ("net: Introduce recvmmsg socket syscall")

Remove this.


> Signed-off-by: Avi Weiss <thnkslprpt@gmail.com>
> ---
>  net/socket.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/net/socket.c b/net/socket.c
> index c2a85224ab55..fff80fbca1a8 100644
> --- a/net/socket.c
> +++ b/net/socket.c
> @@ -3057,13 +3057,10 @@ static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
>  	compat_entry = (struct compat_mmsghdr __user *)mmsg;
>  
>  	while (datagrams < vlen) {
> -		/*
> -		 * No need to ask LSM for more than the first datagram.
> -		 */
>  		if (MSG_CMSG_COMPAT & flags) {
>  			err = ___sys_recvmsg(sock, (struct user_msghdr __user *)compat_entry,
>  					     &msg_sys, flags & ~MSG_WAITFORONE,
> -					     datagrams);
> +					     0);
>  			if (err < 0)
>  				break;
>  			err = put_user(err, &compat_entry->msg_len);
> @@ -3072,7 +3069,7 @@ static int do_recvmmsg(int fd, struct mmsghdr __user *mmsg,
>  			err = ___sys_recvmsg(sock,
>  					     (struct user_msghdr __user *)entry,
>  					     &msg_sys, flags & ~MSG_WAITFORONE,
> -					     datagrams);
> +					     0);

This makes nosec dead in every path.

---
pw-bot: cr


>  			if (err < 0)
>  				break;
>  			err = put_user(err, &entry->msg_len);
> -- 
> 2.43.0
>