net: use put_user() for msghdr results written back to user space

____sys_recvmsg() writes msg_flags and msg_controllen back with
__put_user(), and the compat sendmmsg()/recvmmsg() loops write msg_len
the same way.  None of these has an access_ok() of its own: they rely on
the earlier copy_from_user() of the message header having checked the
range.  For the compat msg_len that is not even true, since msg_len
lives after the compat_msghdr that was copied.  It is only safe because
compat pointers are 32-bit.  The native mmsg paths already use
put_user().

Use put_user() everywhere.  On x86 that adds a couple of instructions to
check the address, on a path that has to enable and disable user access
for each write anyway.

This is part of getting rid of __get_user() and __put_user() entirely.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

0 files changed, 0 insertions, 0 deletions