net: Cap number of elements for sendmmsg

To limit the amount of time we can spend in sendmmsg, cap the
number of elements to UIO_MAXIOV (currently 1024).

For error handling an application using sendmmsg needs to retry at
the first unsent message, so capping is simpler and requires less
application logic than returning EINVAL.

Signed-off-by: Anton Blanchard <anton@samba.org>
Cc: stable <stable@kernel.org> [3.0+]
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/socket.c b/net/socket.c
index e4ed2359eb43db5277503c9a623d1b2f560c1624..b5c6de4f268a170423de9542299a184d980b984c 100644 (file)
--- a/net/socket.c
+++ b/net/socket.c
@@ -1999,6 +1999,9 @@ int __sys_sendmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
        struct compat_mmsghdr __user *compat_entry;
        struct msghdr msg_sys;
 
+       if (vlen > UIO_MAXIOV)
+               vlen = UIO_MAXIOV;
+
        datagrams = 0;
 
        sock = sockfd_lookup_light(fd, &err, &fput_needed);