>Number: 60748
>Category: kern
>Synopsis: compat_linux: possible integer truncation/overflow issues in socket syscalls
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: kern-bug-people
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Sat Sep 19 23:35:00 +0000 2026
>Originator: Taylor R Campbell
>Release: current, 11, 10, ...
>Organization:
Acme Compatibility Truncation, Inc.
>Environment:
>Description:
1. Conversion between Linux and BSD struct msghdr can't quite
round-trip because the types aren't compatible:
141 struct linux_msghdr {
142 void *msg_name;
143 int msg_namelen;
144 struct iovec *msg_iov;
145 size_t msg_iovlen;
146 void *msg_control;
147 size_t msg_controllen;
148 unsigned int msg_flags;
149 };
https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_socket.h?r=1.27#141
481 struct msghdr {
482 void *msg_name; /* optional address */
483 socklen_t msg_namelen; /* size of address */
484 struct iovec *msg_iov; /* scatter/gather array */
485 int msg_iovlen; /* # elements in msg_iov */
486 void *msg_control; /* ancillary data, see below */
487 socklen_t msg_controllen; /* ancillary data buffer len */
488 int msg_flags; /* flags on received message */
489 };
https://nxr.netbsd.org/xref/src/sys/sys/socket.h?r=1.134#477
So the unconditional logic to convert between them might
have integer truncation that could lead to trouble
downstream:
https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_socket.c?r=1.158#440
2. On LP32 platforms, possible issues with ssize_t vs socklen_t
arithmetic:
https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_socket.c?r=1.158#506
>How-To-Repeat:
code inspection
>Fix:
1. (a) check for oversize inputs in linux_to_bsd_msghdr
(b) prove and assert inputs fit in bsd_to_linux_msghdr
(c) ctassert anything that can be ctasserted
2. (a) use socklen_t instead of ssize_t
(b) check arithmetic before doing it to avoid negative
intermediate quantities