Re: [PATCH net v4] tcp: devmem: don't write truncated dmabuf CMSGs to userspace

[Eric Dumazet]

On Mon, Feb 24, 2025 at 6:44 PM Stanislav Fomichev <sdf@xxxxxxxxxxx> wrote:
>
> Currently, we report -ETOOSMALL (err) only on the first iteration
> (!sent). When we get put_cmsg error after a bunch of successful
> put_cmsg calls, we don't signal the error at all. This might be
> confusing on the userspace side which will see truncated CMSGs
> but no MSG_CTRUNC signal.
>
> Consider the following case:
> - sizeof(struct cmsghdr) = 16
> - sizeof(struct dmabuf_cmsg) = 24
> - total cmsg size (CMSG_LEN) = 40 (16+24)
>
> When calling recvmsg with msg_controllen=60, the userspace
> will receive two(!) dmabuf_cmsg(s), the first one will
> be a valid one and the second one will be silently truncated. There is no
> easy way to discover the truncation besides doing something like
> "cm->cmsg_len != CMSG_LEN(sizeof(dmabuf_cmsg))".
>
> Introduce new put_devmem_cmsg wrapper that reports an error instead
> of doing the truncation. Mina suggests that it's the intended way
> this API should work.
>
> Note that we might now report MSG_CTRUNC when the users (incorrectly)
> call us with msg_control == NULL.
>
> Fixes: 8f0b3cc9a4c1 ("tcp: RX path for devmem TCP")
> Reviewed-by: Mina Almasry <almasrymina@xxxxxxxxxx>
> Signed-off-by: Stanislav Fomichev <sdf@xxxxxxxxxxx>

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>