From: bluhm <bluhm@openbsd.org>
Date: Mon, 30 Oct 2023 13:27:53 +0000 (+0000)
Subject: Do not truncate MSG_EOR in recvmsg().
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=4683896a2bef6851772ab6df858176ae5cc7221c;p=openbsd

Do not truncate MSG_EOR in recvmsg().

The soreceive() code depends on the fact that MSG_EOR is set on the
last mbuf of the chain.  In sbappendcontrol() move MSG_EOR to the
end like sbcompress() does it.  This fixes MSG_EOR handling for
SOCK_SEQPACKET sockets with control message.

bug reported by Eric Wong
analysed, tested and OK claudio@
---

diff --git a/sys/kern/uipc_socket2.c b/sys/kern/uipc_socket2.c
index e6cc57fdf9c..f21e0e20ab8 100644
--- a/sys/kern/uipc_socket2.c
+++ b/sys/kern/uipc_socket2.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_socket2.c,v 1.137 2023/07/04 22:28:24 mvs Exp $	*/
+/*	$OpenBSD: uipc_socket2.c,v 1.138 2023/10/30 13:27:53 bluhm Exp $	*/
 /*	$NetBSD: uipc_socket2.c,v 1.11 1996/02/04 02:17:55 christos Exp $	*/
 
 /*
@@ -920,7 +920,7 @@ sbappendcontrol(struct socket *so, struct sockbuf *sb, struct mbuf *m0,
     struct mbuf *control)
 {
 	struct mbuf *m, *mlast, *n;
-	int space = 0;
+	int eor = 0, space = 0;
 
 	if (control == NULL)
 		panic("sbappendcontrol");
@@ -930,8 +930,16 @@ sbappendcontrol(struct socket *so, struct sockbuf *sb, struct mbuf *m0,
 			break;
 	}
 	n = m;			/* save pointer to last control buffer */
-	for (m = m0; m; m = m->m_next)
+	for (m = m0; m; m = m->m_next) {
 		space += m->m_len;
+		eor |= m->m_flags & M_EOR;
+		if (eor) {
+			if (m->m_next == NULL)
+				m->m_flags |= M_EOR;
+			else
+				m->m_flags &= ~M_EOR;
+		}
+	}
 	if (space > sbspace(so, sb))
 		return (0);
 	n->m_next = m0;			/* concatenate data to control */