Don't overwrite the user iov pointer in sendmmsg. Make the send and receive

code look the same.
This commit is contained in:
christos 2015-11-01 17:23:36 +00:00
parent f5789f4f44
commit 4cc78eb1fb
1 changed files with 8 additions and 7 deletions

View File

@ -1,4 +1,4 @@
/* $NetBSD: uipc_syscalls.c,v 1.180 2015/08/24 22:21:26 pooka Exp $ */
/* $NetBSD: uipc_syscalls.c,v 1.181 2015/11/01 17:23:36 christos Exp $ */
/*-
* Copyright (c) 2008, 2009 The NetBSD Foundation, Inc.
@ -61,7 +61,7 @@
*/
#include <sys/cdefs.h>
__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.180 2015/08/24 22:21:26 pooka Exp $");
__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.181 2015/11/01 17:23:36 christos Exp $");
#ifdef _KERNEL_OPT
#include "opt_pipe.h"
@ -560,10 +560,10 @@ do_sys_sendmsg_so(struct lwp *l, int s, struct socket *so, file_t *fp,
if (error)
goto bad;
}
mp->msg_iov = iov;
}
auio.uio_iov = iov;
} else
auio.uio_iov = mp->msg_iov;
auio.uio_iov = mp->msg_iov;
auio.uio_iovcnt = mp->msg_iovlen;
auio.uio_rw = UIO_WRITE;
auio.uio_offset = 0; /* XXX */
@ -571,7 +571,8 @@ do_sys_sendmsg_so(struct lwp *l, int s, struct socket *so, file_t *fp,
KASSERT(l == curlwp);
auio.uio_vmspace = l->l_proc->p_vmspace;
for (i = 0, tiov = mp->msg_iov; i < mp->msg_iovlen; i++, tiov++) {
tiov = auio.uio_iov;
for (i = 0; i < auio.uio_iovcnt; i++, tiov++) {
/*
* Writes return ssize_t because -1 is returned on error.
* Therefore, we must restrict the length to SSIZE_MAX to
@ -951,7 +952,7 @@ do_sys_recvmsg_so(struct lwp *l, int s, struct socket *so, struct msghdr *mp,
auio.uio_vmspace = l->l_proc->p_vmspace;
tiov = auio.uio_iov;
for (i = 0; i < mp->msg_iovlen; i++, tiov++) {
for (i = 0; i < auio.uio_iovcnt; i++, tiov++) {
/*
* Reads return ssize_t because -1 is returned on error.
* Therefore we must restrict the length to SSIZE_MAX to