NetBSD-Bugs archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

kern/60748: compat_linux: possible integer truncation/overflow issues in socket syscalls



>Number:         60748
>Category:       kern
>Synopsis:       compat_linux: possible integer truncation/overflow issues in socket syscalls
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 19 23:35:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
Acme Compatibility Truncation, Inc.
>Environment:
>Description:

	1. Conversion between Linux and BSD struct msghdr can't quite
	   round-trip because the types aren't compatible:

    141 struct linux_msghdr {
    142 	void		*msg_name;
    143 	int		msg_namelen;
    144 	struct iovec	*msg_iov;
    145 	size_t		msg_iovlen;
    146 	void		*msg_control;
    147 	size_t		msg_controllen;
    148 	unsigned int	msg_flags;
    149 };

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_socket.h?r=1.27#141

    481 struct msghdr {
    482 	void		*msg_name;	/* optional address */
    483 	socklen_t	msg_namelen;	/* size of address */
    484 	struct iovec	*msg_iov;	/* scatter/gather array */
    485 	int		msg_iovlen;	/* # elements in msg_iov */
    486 	void		*msg_control;	/* ancillary data, see below */
    487 	socklen_t	msg_controllen;	/* ancillary data buffer len */
    488 	int		msg_flags;	/* flags on received message */
    489 };

	   https://nxr.netbsd.org/xref/src/sys/sys/socket.h?r=1.134#477

	   So the unconditional logic to convert between them might
	   have integer truncation that could lead to trouble
	   downstream:

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_socket.c?r=1.158#440

	2. On LP32 platforms, possible issues with ssize_t vs socklen_t
	   arithmetic:

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_socket.c?r=1.158#506

>How-To-Repeat:

	code inspection

>Fix:

	1. (a) check for oversize inputs in linux_to_bsd_msghdr
	   (b) prove and assert inputs fit in bsd_to_linux_msghdr
	   (c) ctassert anything that can be ctasserted

	2. (a) use socklen_t instead of ssize_t
	   (b) check arithmetic before doing it to avoid negative
	       intermediate quantities




Home | Main Index | Thread Index | Old Index