NetBSD Problem Report #60749

From www@netbsd.org  Sun Sep 20 10:46:55 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 837641A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sun, 20 Sep 2026 10:46:55 +0000 (UTC)
Message-Id: <20260920104654.663DC1A923C@mollari.NetBSD.org>
Date: Sun, 20 Sep 2026 10:46:54 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: compat: successive copyout error branch mistakes
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60749
>Category:       kern
>Synopsis:       compat: successive copyout error branch mistakes
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sun Sep 20 10:50:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Fri Oct 02 03:23:14 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, ...
>Organization:
The CompatBSD Copying, Ouc.
>Environment:
>Description:

	compat_43_sys_recvmsg copies out the socket name, and then only
	if that _failed_ copies out the msghdr -- presumably it was
	meant to copy out the msghdr only if that _succeeded_:

    271 	error = copyout_sockname((struct sockaddr *)omsg.msg_name, &omsg.msg_namelen, 0, from);
    272 	if (from != NULL)
    273 		m_free(from);
    274 
    275 	if (error != 0)
    276 		 error = copyout(&omsg, SCARG(uap, msg), sizeof(omsg));

	https://nxr.netbsd.org/xref/src/sys/compat/common/uipc_syscalls_43.c?r=1.51#271

	Same with the compat32 version:

    491 	error = copyout_sockname(NETBSD32PTR64(omsg.msg_name),
    492 	    &omsg.msg_namelen, 0, from);
    493 	if (from != NULL)
    494 		m_free(from);
    495 
    496 	if (error != 0)
    497 		 error = copyout(&omsg, SCARG_P32(uap, msg), sizeof(omsg));

	https://nxr.netbsd.org/xref/src/sys/compat/netbsd32/netbsd32_compat_43.c?r=1.65#491

>How-To-Repeat:

	code inspection

>Fix:

	Always, always, always structure error branches like this as

		error = ...;
		if (error)
			goto out;
		error = ...;
		if (error)
			goto out;

	instead of tangling success cases inside branches with failure
	cases.  (Exception only if there is a chain of fallbacks in
	case of failure.)

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60749 CVS commit: src/sys/compat
Date: Sun, 20 Sep 2026 13:41:06 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Sun Sep 20 13:41:06 UTC 2026

 Modified Files:
 	src/sys/compat/common: uipc_syscalls_43.c
 	src/sys/compat/netbsd32: netbsd32_compat_43.c

 Log Message:
 compat: Fix successive-copyout chained error branches.

 PR kern/60749: compat: successive copyout error branch mistakes


 To generate a diff of this commit:
 cvs rdiff -u -r1.51 -r1.52 src/sys/compat/common/uipc_syscalls_43.c
 cvs rdiff -u -r1.65 -r1.66 src/sys/compat/netbsd32/netbsd32_compat_43.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Fri, 02 Oct 2026 03:23:14 +0000
State-Changed-Why:
fixed in HEAD, needs pullup-11, pullup-10


>Unformatted:

Home	PR Database Search