From 679a91d17958399441836534283ddd966b8c949b Mon Sep 17 00:00:00 2001
From: Augustin Cavalier <waddlesplash@gmail.com>
Date: Fri, 3 Jun 2022 17:16:52 -0400
Subject: [PATCH] network/stack: Simplify access to msg_iov in socket_send.

As the TODO comment noted, msg_iov has already been copied to the kernel
at this point (it is done in the syscall handler), so we do not need to
use the user memory access functions.

(I verified that the iovecs passed from userland are indeed copied to
the kernel, but I did not find anything that actually posts more than
a single iov, so this is not tested especially thoroughly.)
---
 .../kernel/network/stack/net_socket.cpp       | 37 +++----------------
 1 file changed, 6 insertions(+), 31 deletions(-)

diff --git a/src/add-ons/kernel/network/stack/net_socket.cpp b/src/add-ons/kernel/network/stack/net_socket.cpp
index 814a7523ae..59ecb3048f 100644
--- a/src/add-ons/kernel/network/stack/net_socket.cpp
+++ b/src/add-ons/kernel/network/stack/net_socket.cpp
@@ -162,23 +162,6 @@ net_socket_private::RemoveFromParent()
 //	#pragma mark -
 
 
-static size_t
-compute_user_iovec_length(iovec* userVec, uint32 count)
-{
-	size_t length = 0;
-
-	for (uint32 i = 0; i < count; i++) {
-		iovec vec;
-		if (user_memcpy(&vec, userVec + i, sizeof(iovec)) < B_OK)
-			return 0;
-
-		length += vec.iov_len;
-	}
-
-	return length;
-}
-
-
 static status_t
 create_socket(int family, int type, int protocol, net_socket_private** _socket)
 {
@@ -1420,12 +1403,11 @@ socket_send(net_socket* socket, msghdr* header, const void* data, size_t length,
 	// iovec. So drop the header, if it is the only iovec. Otherwise compute
 	// the size of the remaining ones.
 	if (header != NULL) {
-		if (header->msg_iovlen <= 1)
+		if (header->msg_iovlen <= 1) {
 			header = NULL;
-		else {
-// TODO: The iovecs have already been copied to kernel space. Simplify!
-			bytesLeft += compute_user_iovec_length(header->msg_iov + 1,
-				header->msg_iovlen - 1);
+		} else {
+			for (int i = 1; i < header->msg_iovlen; i++)
+				bytesLeft += header->msg_iov[i].iov_len;
 		}
 	}
 
@@ -1443,15 +1425,8 @@ socket_send(net_socket* socket, msghdr* header, const void* data, size_t length,
 			&& buffer->size < bytesLeft) {
 			if (vecIndex > 0 && vecOffset == 0) {
 				// retrieve next iovec buffer from header
-				iovec vec;
-				if (user_memcpy(&vec, header->msg_iov + vecIndex, sizeof(iovec))
-						< B_OK) {
-					gNetBufferModule.free(buffer);
-					return B_BAD_ADDRESS;
-				}
-
-				data = vec.iov_base;
-				length = vec.iov_len;
+				data = header->msg_iov[vecIndex].iov_base;
+				length = header->msg_iov[vecIndex].iov_len;
 			}
 
 			size_t bytes = length;