git: 82062a044383 - stable/13 - linux(4): Handle multiple mbufs in a control message chain in recvmsg

The branch stable/13 has been updated by dchagin:

URL: https://cgit.FreeBSD.org/src/commit/?id=82062a044383ecb402a1f003249359616a660390

commit 82062a044383ecb402a1f003249359616a660390
Author:     Dmitry Chagin <dchagin@FreeBSD.org>
AuthorDate: 2022-05-28 20:48:45 +0000
Commit:     Dmitry Chagin <dchagin@FreeBSD.org>
CommitDate: 2022-06-17 19:35:37 +0000

    linux(4): Handle multiple mbufs in a control message chain in recvmsg
    
    PR:             230274
    MFC after:      2 weeks
    
    (cherry picked from commit 3735f9cff1e8a7ce7079b957bc3b37f0f886caed)
---
 sys/compat/linux/linux_socket.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/sys/compat/linux/linux_socket.c b/sys/compat/linux/linux_socket.c
index 67da1b51a86e..9434e40709bb 100644
--- a/sys/compat/linux/linux_socket.c
+++ b/sys/compat/linux/linux_socket.c
@@ -1727,7 +1727,7 @@ linux_recvmsg_common(struct thread *td, l_int s, struct l_msghdr *msghdr,
 	socklen_t datalen, maxlen, outlen;
 	struct l_msghdr l_msghdr;
 	struct iovec *iov, *uiov;
-	struct mbuf *control = NULL;
+	struct mbuf *m, *control = NULL;
 	struct mbuf **controlp;
 	struct sockaddr *sa;
 	caddr_t outbuf;
@@ -1797,10 +1797,10 @@ linux_recvmsg_common(struct thread *td, l_int s, struct l_msghdr *msghdr,
 	lcm = malloc(L_CMSG_HDRSZ, M_LINUX, M_WAITOK | M_ZERO);
 	msg->msg_control = mtod(control, struct cmsghdr *);
 	msg->msg_controllen = control->m_len;
-	cm = CMSG_FIRSTHDR(msg);
 	outbuf = PTRIN(l_msghdr.msg_control);
 	outlen = 0;
-	while (cm != NULL) {
+	for (m = control; m != NULL; m = m->m_next) {
+		cm = mtod(m, struct cmsghdr *);
 		lcm->cmsg_type = bsd_to_linux_cmsg_type(p, cm->cmsg_type,
 		    cm->cmsg_level);
 		lcm->cmsg_level = bsd_to_linux_sockopt_level(cm->cmsg_level);
@@ -1876,7 +1876,6 @@ cont:
 			if (error == 0) {
 				outbuf += LINUX_CMSG_ALIGN(datalen);
 				outlen += LINUX_CMSG_LEN(datalen);
-				cm = CMSG_NXTHDR(msg, cm);
 			}
 		}
 err: