NetBSD Problem Report #60748

From www@netbsd.org  Sat Sep 19 23:30:33 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 3CD311A923E
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 19 Sep 2026 23:30:33 +0000 (UTC)
Message-Id: <20260919233031.F03F21A923F@mollari.NetBSD.org>
Date: Sat, 19 Sep 2026 23:30:31 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: compat_linux: possible integer truncation/overflow issues in socket syscalls
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60748
>Category:       kern
>Synopsis:       compat_linux: possible integer truncation/overflow issues in socket syscalls
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Sep 19 23:35:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Fri Oct 02 03:22:45 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
Acme Compatibility Truncation, Inc.
>Environment:
>Description:

	1. Conversion between Linux and BSD struct msghdr can't quite
	   round-trip because the types aren't compatible:

    141 struct linux_msghdr {
    142 	void		*msg_name;
    143 	int		msg_namelen;
    144 	struct iovec	*msg_iov;
    145 	size_t		msg_iovlen;
    146 	void		*msg_control;
    147 	size_t		msg_controllen;
    148 	unsigned int	msg_flags;
    149 };

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_socket.h?r=1.27#141

    481 struct msghdr {
    482 	void		*msg_name;	/* optional address */
    483 	socklen_t	msg_namelen;	/* size of address */
    484 	struct iovec	*msg_iov;	/* scatter/gather array */
    485 	int		msg_iovlen;	/* # elements in msg_iov */
    486 	void		*msg_control;	/* ancillary data, see below */
    487 	socklen_t	msg_controllen;	/* ancillary data buffer len */
    488 	int		msg_flags;	/* flags on received message */
    489 };

	   https://nxr.netbsd.org/xref/src/sys/sys/socket.h?r=1.134#477

	   So the unconditional logic to convert between them might
	   have integer truncation that could lead to trouble
	   downstream:

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_socket.c?r=1.158#440

	2. On LP32 platforms, possible issues with ssize_t vs socklen_t
	   arithmetic:

	   https://nxr.netbsd.org/xref/src/sys/compat/linux/common/linux_socket.c?r=1.158#506

>How-To-Repeat:

	code inspection

>Fix:

	1. (a) check for oversize inputs in linux_to_bsd_msghdr
	   (b) prove and assert inputs fit in bsd_to_linux_msghdr
	   (c) ctassert anything that can be ctasserted

	2. (a) use socklen_t instead of ssize_t
	   (b) check arithmetic before doing it to avoid negative
	       intermediate quantities

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60748 CVS commit: src/sys/compat/linux/common
Date: Sat, 19 Sep 2026 23:47:37 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Sep 19 23:47:37 UTC 2026

 Modified Files:
 	src/sys/compat/linux/common: linux_socket.c

 Log Message:
 compat_linux: Verify struct msghdr sizes more carefully..

 PR kern/60748: compat_linux: possible integer truncation/overflow
 issues in socket syscalls


 To generate a diff of this commit:
 cvs rdiff -u -r1.158 -r1.159 src/sys/compat/linux/common/linux_socket.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60748 CVS commit: src/sys/compat/linux/common
Date: Sat, 19 Sep 2026 23:47:52 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sat Sep 19 23:47:52 UTC 2026

 Modified Files:
 	src/sys/compat/linux/common: linux_socket.c

 Log Message:
 compat_linux sendmsg(2): Handle msg_controllen more cautiously.

 Also add an assertion about cmsg_len arithmetic in recvmsg(2) and
 recvmmsg(2).

 PR kern/60748: compat_linux: possible integer truncation/overflow
 issues in socket syscalls


 To generate a diff of this commit:
 cvs rdiff -u -r1.159 -r1.160 src/sys/compat/linux/common/linux_socket.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60748 CVS commit: src/sys/compat/linux/common
Date: Sun, 20 Sep 2026 13:40:23 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:40:22 UTC 2026

 Modified Files:
 	src/sys/compat/linux/common: linux_socket.c

 Log Message:
 compat_linux recv(m)msg(2): Tighten arithmetic bounds.

 And avoid overflow test idioms that involve doing the overflow.

 PR kern/60748: compat_linux: possible integer truncation/overflow
 issues in socket syscalls


 To generate a diff of this commit:
 cvs rdiff -u -r1.160 -r1.161 src/sys/compat/linux/common/linux_socket.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60748 CVS commit: src/sys/compat/linux/common
Date: Sun, 20 Sep 2026 13:40:50 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:40:50 UTC 2026

 Modified Files:
 	src/sys/compat/linux/common: linux_socket.c

 Log Message:
 compat_linux recv(m)msg(2): Fix mistakes in error branches.

 1. If copying out the cmsghdr _succeeds_, we want to copy out the
    cmsg data -- not if copying out the cmsghdr _fails_.

 2. If any part of the BSD cmsg to Linux cmsg conversion or copyout
    _fails_, we must pass the whole mbuf chain to free_control_mbuf to
    close all the file descriptors in it -- otherwise, they would leak
    because the user process has no idea it has been given the fds.

 3. Add missing `if (error)' before `return error' in recvmmsg(2)
    branch for copying in timeout.

 Found while reviewing code nearby:

 PR kern/60748: compat_linux: possible integer truncation/overflow
 issues in socket syscalls


 To generate a diff of this commit:
 cvs rdiff -u -r1.161 -r1.162 src/sys/compat/linux/common/linux_socket.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Fri, 02 Oct 2026 03:22:45 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11 and pullup-10

Also needs review to make sure I caught everything!


>Unformatted:

Home	PR Database Search