(nuttx) branch master updated: net/socket: fix recvfrom kernel copyout length

[xi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

xiaoxiang781216 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx.git


The following commit(s) were added to refs/heads/master by this push:
     new 0be74ca5454 net/socket: fix recvfrom kernel copyout length
0be74ca5454 is described below

commit 0be74ca5454241ffaae95f371fdb145a183561fd
Author: chao an <an...@bytedance.com>
AuthorDate: Wed Oct 21 13:17:06 2026 +0800

    net/socket: fix recvfrom kernel copyout length
    
    In kernel builds, recvfrom() receives data into a temporary kernel buffer
    before copying the result back to the user buffer.  The old code copied
    the full requested length regardless of how many bytes were actually
    received, which could copy uninitialized bytes from the kernel buffer on
    short receives.
    
    Only copy data back when bytes were received, and limit the copyout size
    to the number of bytes returned by psock_recvfrom().  Also avoid copying
    the source address back to user space when the receive operation failed.
    
    Signed-off-by: chao an <an...@bytedance.com>
---
 net/socket/recvfrom.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/net/socket/recvfrom.c b/net/socket/recvfrom.c
index c4462bfdb78..6aa59dec38c 100644
--- a/net/socket/recvfrom.c
+++ b/net/socket/recvfrom.c
@@ -95,7 +95,9 @@ ssize_t psock_recvfrom(FAR struct socket *psock, FAR void *buf, size_t len,
 
   ret = psock_recvmsg(psock, &msg, flags);
   if (ret >= 0 && fromlen != NULL)
-    *fromlen = msg.msg_namelen;
+    {
+      *fromlen = msg.msg_namelen;
+    }
 
   return ret;
 }
@@ -204,12 +206,16 @@ ssize_t recvfrom(int sockfd, FAR void *buf, size_t len, int flags,
     }
 
 #ifdef CONFIG_BUILD_KERNEL
-  memcpy(ubuf, buf, len);
+  if (ret > 0)
+    {
+      memcpy(ubuf, buf, ret);
+    }
+
   kmm_free(kbuf);
 
   /* Copy the address back to user */
 
-  if (ufrom)
+  if (ret >= 0 && ufrom)
     {
       memcpy(ufrom, &kaddr, *fromlen);
     }