Commit f3d3342602f8bcbf37d7c46641cb9bca7618eb1c

Authored by Hannes Frederic Sowa
Committed by David S. Miller
1 parent f873042093

net: rework recvmsg handler msg_name and msg_namelen logic

This patch now always passes msg->msg_namelen as 0. recvmsg handlers must
set msg_namelen to the proper size <= sizeof(struct sockaddr_storage)
to return msg_name to the user.

This prevents numerous uninitialized memory leaks we had in the
recvmsg handlers and makes it harder for new code to accidentally leak
uninitialized memory.

Optimize for the case recvfrom is called with NULL as address. We don't
need to copy the address at all, so set it to NULL before invoking the
recvmsg handler. We can do so, because all the recvmsg handlers must
cope with the case a plain read() is called on them. read() also sets
msg_name to NULL.

Also document these changes in include/linux/net.h as suggested by David
Miller.

Changes since RFC:

Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
affect sendto as it would bail out earlier while trying to copy-in the
address. It also more naturally reflects the logic by the callers of
verify_iovec.

With this change in place I could remove "
if (!uaddr || msg_sys->msg_namelen == 0)
	msg->msg_name = NULL
".

This change does not alter the user visible error logic as we ignore
msg_namelen as long as msg_name is NULL.

Also remove two unnecessary curly brackets in ___sys_recvmsg and change
comments to netdev style.

Cc: David Miller <davem@davemloft.net>
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 35 changed files with 67 additions and 115 deletions Side-by-side Diff

... ... @@ -161,8 +161,6 @@
161 161 else if (len < ds)
162 162 msg->msg_flags |= MSG_TRUNC;
163 163  
164   - msg->msg_namelen = 0;
165   -
166 164 lock_sock(sk);
167 165 if (ctx->more) {
168 166 ctx->more = 0;
crypto/algif_skcipher.c
... ... @@ -432,7 +432,6 @@
432 432 long copied = 0;
433 433  
434 434 lock_sock(sk);
435   - msg->msg_namelen = 0;
436 435 for (iov = msg->msg_iov, iovlen = msg->msg_iovlen; iovlen > 0;
437 436 iovlen--, iov++) {
438 437 unsigned long seglen = iov->iov_len;
drivers/isdn/mISDN/socket.c
... ... @@ -117,7 +117,6 @@
117 117 {
118 118 struct sk_buff *skb;
119 119 struct sock *sk = sock->sk;
120   - struct sockaddr_mISDN *maddr;
121 120  
122 121 int copied, err;
123 122  
... ... @@ -135,9 +134,9 @@
135 134 if (!skb)
136 135 return err;
137 136  
138   - if (msg->msg_namelen >= sizeof(struct sockaddr_mISDN)) {
139   - msg->msg_namelen = sizeof(struct sockaddr_mISDN);
140   - maddr = (struct sockaddr_mISDN *)msg->msg_name;
  137 + if (msg->msg_name) {
  138 + struct sockaddr_mISDN *maddr = msg->msg_name;
  139 +
141 140 maddr->family = AF_ISDN;
142 141 maddr->dev = _pms(sk)->dev->id;
143 142 if ((sk->sk_protocol == ISDN_P_LAPD_TE) ||
... ... @@ -150,11 +149,7 @@
150 149 maddr->sapi = _pms(sk)->ch.addr & 0xFF;
151 150 maddr->tei = (_pms(sk)->ch.addr >> 8) & 0xFF;
152 151 }
153   - } else {
154   - if (msg->msg_namelen)
155   - printk(KERN_WARNING "%s: too small namelen %d\n",
156   - __func__, msg->msg_namelen);
157   - msg->msg_namelen = 0;
  152 + msg->msg_namelen = sizeof(*maddr);
158 153 }
159 154  
160 155 copied = skb->len + MISDN_HEADER_LEN;
drivers/net/ppp/pppoe.c
... ... @@ -979,8 +979,6 @@
979 979 if (error < 0)
980 980 goto end;
981 981  
982   - m->msg_namelen = 0;
983   -
984 982 if (skb) {
985 983 total_len = min_t(size_t, total_len, skb->len);
986 984 error = skb_copy_datagram_iovec(skb, 0, m->msg_iov, total_len);
... ... @@ -164,6 +164,14 @@
164 164 #endif
165 165 int (*sendmsg) (struct kiocb *iocb, struct socket *sock,
166 166 struct msghdr *m, size_t total_len);
  167 + /* Notes for implementing recvmsg:
  168 + * ===============================
  169 + * msg->msg_namelen should get updated by the recvmsg handlers
  170 + * iff msg_name != NULL. It is by default 0 to prevent
  171 + * returning uninitialized memory to user space. The recvfrom
  172 + * handlers can assume that msg.msg_name is either NULL or has
  173 + * a minimum size of sizeof(struct sockaddr_storage).
  174 + */
167 175 int (*recvmsg) (struct kiocb *iocb, struct socket *sock,
168 176 struct msghdr *m, size_t total_len,
169 177 int flags);
... ... @@ -1735,7 +1735,6 @@
1735 1735 size_t size, int flags)
1736 1736 {
1737 1737 struct sock *sk = sock->sk;
1738   - struct sockaddr_at *sat = (struct sockaddr_at *)msg->msg_name;
1739 1738 struct ddpehdr *ddp;
1740 1739 int copied = 0;
1741 1740 int offset = 0;
... ... @@ -1764,14 +1763,13 @@
1764 1763 }
1765 1764 err = skb_copy_datagram_iovec(skb, offset, msg->msg_iov, copied);
1766 1765  
1767   - if (!err) {
1768   - if (sat) {
1769   - sat->sat_family = AF_APPLETALK;
1770   - sat->sat_port = ddp->deh_sport;
1771   - sat->sat_addr.s_node = ddp->deh_snode;
1772   - sat->sat_addr.s_net = ddp->deh_snet;
1773   - }
1774   - msg->msg_namelen = sizeof(*sat);
  1766 + if (!err && msg->msg_name) {
  1767 + struct sockaddr_at *sat = msg->msg_name;
  1768 + sat->sat_family = AF_APPLETALK;
  1769 + sat->sat_port = ddp->deh_sport;
  1770 + sat->sat_addr.s_node = ddp->deh_snode;
  1771 + sat->sat_addr.s_net = ddp->deh_snet;
  1772 + msg->msg_namelen = sizeof(*sat);
1775 1773 }
1776 1774  
1777 1775 skb_free_datagram(sk, skb); /* Free the datagram. */
... ... @@ -531,8 +531,6 @@
531 531 struct sk_buff *skb;
532 532 int copied, error = -EINVAL;
533 533  
534   - msg->msg_namelen = 0;
535   -
536 534 if (sock->state != SS_CONNECTED)
537 535 return -ENOTCONN;
538 536  
... ... @@ -1636,11 +1636,11 @@
1636 1636  
1637 1637 skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1638 1638  
1639   - if (msg->msg_namelen != 0) {
1640   - struct sockaddr_ax25 *sax = (struct sockaddr_ax25 *)msg->msg_name;
  1639 + if (msg->msg_name) {
1641 1640 ax25_digi digi;
1642 1641 ax25_address src;
1643 1642 const unsigned char *mac = skb_mac_header(skb);
  1643 + struct sockaddr_ax25 *sax = msg->msg_name;
1644 1644  
1645 1645 memset(sax, 0, sizeof(struct full_sockaddr_ax25));
1646 1646 ax25_addr_parse(mac + 1, skb->data - mac - 1, &src, NULL,
net/bluetooth/af_bluetooth.c
... ... @@ -224,10 +224,9 @@
224 224  
225 225 skb = skb_recv_datagram(sk, flags, noblock, &err);
226 226 if (!skb) {
227   - if (sk->sk_shutdown & RCV_SHUTDOWN) {
228   - msg->msg_namelen = 0;
  227 + if (sk->sk_shutdown & RCV_SHUTDOWN)
229 228 return 0;
230   - }
  229 +
231 230 return err;
232 231 }
233 232  
... ... @@ -245,8 +244,6 @@
245 244 if (bt_sk(sk)->skb_msg_name)
246 245 bt_sk(sk)->skb_msg_name(skb, msg->msg_name,
247 246 &msg->msg_namelen);
248   - else
249   - msg->msg_namelen = 0;
250 247 }
251 248  
252 249 skb_free_datagram(sk, skb);
... ... @@ -294,8 +291,6 @@
294 291  
295 292 if (flags & MSG_OOB)
296 293 return -EOPNOTSUPP;
297   -
298   - msg->msg_namelen = 0;
299 294  
300 295 BT_DBG("sk %p size %zu", sk, size);
301 296  
net/bluetooth/hci_sock.c
... ... @@ -856,8 +856,6 @@
856 856 if (!skb)
857 857 return err;
858 858  
859   - msg->msg_namelen = 0;
860   -
861 859 copied = skb->len;
862 860 if (len < copied) {
863 861 msg->msg_flags |= MSG_TRUNC;
net/bluetooth/rfcomm/sock.c
... ... @@ -615,7 +615,6 @@
615 615  
616 616 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
617 617 rfcomm_dlc_accept(d);
618   - msg->msg_namelen = 0;
619 618 return 0;
620 619 }
621 620  
... ... @@ -711,7 +711,6 @@
711 711 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
712 712 sco_conn_defer_accept(pi->conn->hcon, pi->setting);
713 713 sk->sk_state = BT_CONFIG;
714   - msg->msg_namelen = 0;
715 714  
716 715 release_sock(sk);
717 716 return 0;
net/caif/caif_socket.c
... ... @@ -286,8 +286,6 @@
286 286 if (m->msg_flags&MSG_OOB)
287 287 goto read_error;
288 288  
289   - m->msg_namelen = 0;
290   -
291 289 skb = skb_recv_datagram(sk, flags, 0 , &ret);
292 290 if (!skb)
293 291 goto read_error;
... ... @@ -360,8 +358,6 @@
360 358 err = -EOPNOTSUPP;
361 359 if (flags&MSG_OOB)
362 360 goto out;
363   -
364   - msg->msg_namelen = 0;
365 361  
366 362 /*
367 363 * Lock the socket to prevent queue disordering
... ... @@ -93,7 +93,8 @@
93 93 if (err < 0)
94 94 return err;
95 95 }
96   - kern_msg->msg_name = kern_address;
  96 + if (kern_msg->msg_name)
  97 + kern_msg->msg_name = kern_address;
97 98 } else
98 99 kern_msg->msg_name = NULL;
99 100  
... ... @@ -48,7 +48,8 @@
48 48 if (err < 0)
49 49 return err;
50 50 }
51   - m->msg_name = address;
  51 + if (m->msg_name)
  52 + m->msg_name = address;
52 53 } else {
53 54 m->msg_name = NULL;
54 55 }
... ... @@ -1823,8 +1823,6 @@
1823 1823 if (skb->tstamp.tv64)
1824 1824 sk->sk_stamp = skb->tstamp;
1825 1825  
1826   - msg->msg_namelen = sizeof(*sipx);
1827   -
1828 1826 if (sipx) {
1829 1827 sipx->sipx_family = AF_IPX;
1830 1828 sipx->sipx_port = ipx->ipx_source.sock;
... ... @@ -1832,6 +1830,7 @@
1832 1830 sipx->sipx_network = IPX_SKB_CB(skb)->ipx_source_net;
1833 1831 sipx->sipx_type = ipx->ipx_type;
1834 1832 sipx->sipx_zero = 0;
  1833 + msg->msg_namelen = sizeof(*sipx);
1835 1834 }
1836 1835 rc = copied;
1837 1836  
... ... @@ -1385,8 +1385,6 @@
1385 1385  
1386 1386 IRDA_DEBUG(4, "%s()\n", __func__);
1387 1387  
1388   - msg->msg_namelen = 0;
1389   -
1390 1388 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
1391 1389 flags & MSG_DONTWAIT, &err);
1392 1390 if (!skb)
... ... @@ -1450,8 +1448,6 @@
1450 1448 err = 0;
1451 1449 target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
1452 1450 timeo = sock_rcvtimeo(sk, noblock);
1453   -
1454   - msg->msg_namelen = 0;
1455 1451  
1456 1452 do {
1457 1453 int chunk;
... ... @@ -1324,8 +1324,6 @@
1324 1324 int err = 0;
1325 1325 u32 offset;
1326 1326  
1327   - msg->msg_namelen = 0;
1328   -
1329 1327 if ((sk->sk_state == IUCV_DISCONN) &&
1330 1328 skb_queue_empty(&iucv->backlog_skb_q) &&
1331 1329 skb_queue_empty(&sk->sk_receive_queue) &&
... ... @@ -3616,7 +3616,6 @@
3616 3616 if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
3617 3617 goto out;
3618 3618  
3619   - msg->msg_namelen = 0;
3620 3619 skb = skb_recv_datagram(sk, flags, flags & MSG_DONTWAIT, &err);
3621 3620 if (skb == NULL)
3622 3621 goto out;
... ... @@ -197,8 +197,6 @@
197 197 if (sk->sk_state & PPPOX_BOUND)
198 198 goto end;
199 199  
200   - msg->msg_namelen = 0;
201   -
202 200 err = 0;
203 201 skb = skb_recv_datagram(sk, flags & ~MSG_DONTWAIT,
204 202 flags & MSG_DONTWAIT, &err);
... ... @@ -720,8 +720,6 @@
720 720 int target; /* Read at least this many bytes */
721 721 long timeo;
722 722  
723   - msg->msg_namelen = 0;
724   -
725 723 lock_sock(sk);
726 724 copied = -ENOTCONN;
727 725 if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
net/netlink/af_netlink.c
... ... @@ -2335,8 +2335,6 @@
2335 2335 }
2336 2336 #endif
2337 2337  
2338   - msg->msg_namelen = 0;
2339   -
2340 2338 copied = data_skb->len;
2341 2339 if (len < copied) {
2342 2340 msg->msg_flags |= MSG_TRUNC;
net/netrom/af_netrom.c
... ... @@ -1179,9 +1179,8 @@
1179 1179 sax->sax25_family = AF_NETROM;
1180 1180 skb_copy_from_linear_data_offset(skb, 7, sax->sax25_call.ax25_call,
1181 1181 AX25_ADDR_LEN);
  1182 + msg->msg_namelen = sizeof(*sax);
1182 1183 }
1183   -
1184   - msg->msg_namelen = sizeof(*sax);
1185 1184  
1186 1185 skb_free_datagram(sk, skb);
1187 1186  
... ... @@ -807,8 +807,6 @@
807 807  
808 808 pr_debug("%p %zu\n", sk, len);
809 809  
810   - msg->msg_namelen = 0;
811   -
812 810 lock_sock(sk);
813 811  
814 812 if (sk->sk_state == LLCP_CLOSED &&
... ... @@ -244,8 +244,6 @@
244 244 if (!skb)
245 245 return rc;
246 246  
247   - msg->msg_namelen = 0;
248   -
249 247 copied = skb->len;
250 248 if (len < copied) {
251 249 msg->msg_flags |= MSG_TRUNC;
net/packet/af_packet.c
... ... @@ -2660,7 +2660,6 @@
2660 2660 struct sock *sk = sock->sk;
2661 2661 struct sk_buff *skb;
2662 2662 int copied, err;
2663   - struct sockaddr_ll *sll;
2664 2663 int vnet_hdr_len = 0;
2665 2664  
2666 2665 err = -EINVAL;
2667 2666  
... ... @@ -2744,22 +2743,10 @@
2744 2743 goto out_free;
2745 2744 }
2746 2745  
2747   - /*
2748   - * If the address length field is there to be filled in, we fill
2749   - * it in now.
  2746 + /* You lose any data beyond the buffer you gave. If it worries
  2747 + * a user program they can ask the device for its MTU
  2748 + * anyway.
2750 2749 */
2751   -
2752   - sll = &PACKET_SKB_CB(skb)->sa.ll;
2753   - if (sock->type == SOCK_PACKET)
2754   - msg->msg_namelen = sizeof(struct sockaddr_pkt);
2755   - else
2756   - msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);
2757   -
2758   - /*
2759   - * You lose any data beyond the buffer you gave. If it worries a
2760   - * user program they can ask the device for its MTU anyway.
2761   - */
2762   -
2763 2750 copied = skb->len;
2764 2751 if (copied > len) {
2765 2752 copied = len;
2766 2753  
... ... @@ -2772,9 +2759,20 @@
2772 2759  
2773 2760 sock_recv_ts_and_drops(msg, sk, skb);
2774 2761  
2775   - if (msg->msg_name)
  2762 + if (msg->msg_name) {
  2763 + /* If the address length field is there to be filled
  2764 + * in, we fill it in now.
  2765 + */
  2766 + if (sock->type == SOCK_PACKET) {
  2767 + msg->msg_namelen = sizeof(struct sockaddr_pkt);
  2768 + } else {
  2769 + struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
  2770 + msg->msg_namelen = sll->sll_halen +
  2771 + offsetof(struct sockaddr_ll, sll_addr);
  2772 + }
2776 2773 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
2777 2774 msg->msg_namelen);
  2775 + }
2778 2776  
2779 2777 if (pkt_sk(sk)->auxdata) {
2780 2778 struct tpacket_auxdata aux;
... ... @@ -410,8 +410,6 @@
410 410  
411 411 rdsdebug("size %zu flags 0x%x timeo %ld\n", size, msg_flags, timeo);
412 412  
413   - msg->msg_namelen = 0;
414   -
415 413 if (msg_flags & MSG_OOB)
416 414 goto out;
417 415  
... ... @@ -1216,7 +1216,6 @@
1216 1216 {
1217 1217 struct sock *sk = sock->sk;
1218 1218 struct rose_sock *rose = rose_sk(sk);
1219   - struct sockaddr_rose *srose = (struct sockaddr_rose *)msg->msg_name;
1220 1219 size_t copied;
1221 1220 unsigned char *asmptr;
1222 1221 struct sk_buff *skb;
... ... @@ -1252,8 +1251,11 @@
1252 1251  
1253 1252 skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
1254 1253  
1255   - if (srose != NULL) {
1256   - memset(srose, 0, msg->msg_namelen);
  1254 + if (msg->msg_name) {
  1255 + struct sockaddr_rose *srose;
  1256 +
  1257 + memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
  1258 + srose = msg->msg_name;
1257 1259 srose->srose_family = AF_ROSE;
1258 1260 srose->srose_addr = rose->dest_addr;
1259 1261 srose->srose_call = rose->dest_call;
net/rxrpc/ar-recvmsg.c
... ... @@ -143,10 +143,13 @@
143 143  
144 144 /* copy the peer address and timestamp */
145 145 if (!continue_call) {
146   - if (msg->msg_name && msg->msg_namelen > 0)
  146 + if (msg->msg_name) {
  147 + size_t len =
  148 + sizeof(call->conn->trans->peer->srx);
147 149 memcpy(msg->msg_name,
148   - &call->conn->trans->peer->srx,
149   - sizeof(call->conn->trans->peer->srx));
  150 + &call->conn->trans->peer->srx, len);
  151 + msg->msg_namelen = len;
  152 + }
150 153 sock_recv_ts_and_drops(msg, &rx->sk, skb);
151 154 }
152 155  
... ... @@ -1840,8 +1840,10 @@
1840 1840 msg.msg_iov = &iov;
1841 1841 iov.iov_len = size;
1842 1842 iov.iov_base = ubuf;
1843   - msg.msg_name = (struct sockaddr *)&address;
1844   - msg.msg_namelen = sizeof(address);
  1843 + /* Save some cycles and don't copy the address if not needed */
  1844 + msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
  1845 + /* We assume all kernel code knows the size of sockaddr_storage */
  1846 + msg.msg_namelen = 0;
1845 1847 if (sock->file->f_flags & O_NONBLOCK)
1846 1848 flags |= MSG_DONTWAIT;
1847 1849 err = sock_recvmsg(sock, &msg, size, flags);
1848 1850  
1849 1851  
1850 1852  
... ... @@ -2221,16 +2223,14 @@
2221 2223 goto out;
2222 2224 }
2223 2225  
2224   - /*
2225   - * Save the user-mode address (verify_iovec will change the
2226   - * kernel msghdr to use the kernel address space)
  2226 + /* Save the user-mode address (verify_iovec will change the
  2227 + * kernel msghdr to use the kernel address space)
2227 2228 */
2228   -
2229 2229 uaddr = (__force void __user *)msg_sys->msg_name;
2230 2230 uaddr_len = COMPAT_NAMELEN(msg);
2231   - if (MSG_CMSG_COMPAT & flags) {
  2231 + if (MSG_CMSG_COMPAT & flags)
2232 2232 err = verify_compat_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
2233   - } else
  2233 + else
2234 2234 err = verify_iovec(msg_sys, iov, &addr, VERIFY_WRITE);
2235 2235 if (err < 0)
2236 2236 goto out_freeiov;
... ... @@ -2238,6 +2238,9 @@
2238 2238  
2239 2239 cmsg_ptr = (unsigned long)msg_sys->msg_control;
2240 2240 msg_sys->msg_flags = flags & (MSG_CMSG_CLOEXEC|MSG_CMSG_COMPAT);
  2241 +
  2242 + /* We assume all kernel code knows the size of sockaddr_storage */
  2243 + msg_sys->msg_namelen = 0;
2241 2244  
2242 2245 if (sock->file->f_flags & O_NONBLOCK)
2243 2246 flags |= MSG_DONTWAIT;
... ... @@ -980,9 +980,6 @@
980 980 goto exit;
981 981 }
982 982  
983   - /* will be updated in set_orig_addr() if needed */
984   - m->msg_namelen = 0;
985   -
986 983 timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
987 984 restart:
988 985  
... ... @@ -1090,9 +1087,6 @@
1090 1087 res = -ENOTCONN;
1091 1088 goto exit;
1092 1089 }
1093   -
1094   - /* will be updated in set_orig_addr() if needed */
1095   - m->msg_namelen = 0;
1096 1090  
1097 1091 target = sock_rcvlowat(sk, flags & MSG_WAITALL, buf_len);
1098 1092 timeout = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
... ... @@ -1754,7 +1754,6 @@
1754 1754 {
1755 1755 struct unix_sock *u = unix_sk(sk);
1756 1756  
1757   - msg->msg_namelen = 0;
1758 1757 if (u->addr) {
1759 1758 msg->msg_namelen = u->addr->len;
1760 1759 memcpy(msg->msg_name, u->addr->name, u->addr->len);
... ... @@ -1778,8 +1777,6 @@
1778 1777 if (flags&MSG_OOB)
1779 1778 goto out;
1780 1779  
1781   - msg->msg_namelen = 0;
1782   -
1783 1780 err = mutex_lock_interruptible(&u->readlock);
1784 1781 if (err) {
1785 1782 err = sock_intr_errno(sock_rcvtimeo(sk, noblock));
... ... @@ -1923,8 +1920,6 @@
1923 1920  
1924 1921 target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
1925 1922 timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT);
1926   -
1927   - msg->msg_namelen = 0;
1928 1923  
1929 1924 /* Lock the socket to prevent queue disordering
1930 1925 * while sleeps in memcpy_tomsg
net/vmw_vsock/af_vsock.c
... ... @@ -1662,8 +1662,6 @@
1662 1662 vsk = vsock_sk(sk);
1663 1663 err = 0;
1664 1664  
1665   - msg->msg_namelen = 0;
1666   -
1667 1665 lock_sock(sk);
1668 1666  
1669 1667 if (sk->sk_state != SS_CONNECTED) {
net/vmw_vsock/vmci_transport.c
... ... @@ -1746,8 +1746,6 @@
1746 1746 if (flags & MSG_OOB || flags & MSG_ERRQUEUE)
1747 1747 return -EOPNOTSUPP;
1748 1748  
1749   - msg->msg_namelen = 0;
1750   -
1751 1749 /* Retrieve the head sk_buff from the socket's receive queue. */
1752 1750 err = 0;
1753 1751 skb = skb_recv_datagram(&vsk->sk, flags, noblock, &err);
... ... @@ -1340,9 +1340,8 @@
1340 1340 if (sx25) {
1341 1341 sx25->sx25_family = AF_X25;
1342 1342 sx25->sx25_addr = x25->dest_addr;
  1343 + msg->msg_namelen = sizeof(*sx25);
1343 1344 }
1344   -
1345   - msg->msg_namelen = sizeof(struct sockaddr_x25);
1346 1345  
1347 1346 x25_check_rbuf(sk);
1348 1347 rc = copied;