Swatantra-66 opened a new pull request, #21735: URL: https://github.com/apache/nuttx/pull/21735
## Summary POSIX IEEE Std 1003.1 mandates that `sendmsg()` and `recvmsg()` validate `msg_iovlen` and return `-EMSGSIZE` when `msg_iovlen <= 0 || msg_iovlen > IOV_MAX`. Furthermore, dereferencing `msg->msg_iov` before validating `msg_iovlen` and checking `msg_iov != NULL` risks kernel panics due to null-pointer dereferences (CWE-476) or out-of-bounds reads (CWE-125). This patch hardens `net/pkt` (packet sockets): 1. **Deferred Dereference**: Defers dereferencing `msg->msg_iov` in `pkt_sendmsg_unbuffered.c` and `pkt_sendmsg_buffered.c` until after `pkt_sendmsg_is_valid()` validates input arguments. 2. **POSIX `[EMSGSIZE]` Compliance**: Returns `-EMSGSIZE` when `msg_iovlen == 0 || msg_iovlen > IOV_MAX` in both `pkt_sendmsg_is_valid()` and `pkt_recvmsg()`, while preserving `-ENOTSUP` for `msg_iovlen > 1`. 3. **Buffer Validation**: Validates `msg_iov != NULL` and rejects buffers with `iov_len > 0 && iov_base == NULL` with `-EINVAL`. 4. **POSIX `MSG_TRUNC`**: Initializes `msg->msg_flags = 0` in `pkt_recvmsg()`, sets `MSG_TRUNC` when payload exceeds buffer capacity in `pkt_readdata()`, and correctly accounts for link-layer header stripping on `SOCK_DGRAM` sockets in `pkt_recvfrom_newdata()` to avoid spurious truncation flags. 5. **Includes `<limits.h>`**: Provides standard `IOV_MAX`. ## Before vs After | Vulnerability / POSIX Gap | Before This Patch | After This Patch | POSIX / CWE Standard | |---|---|---|---| | **Early Dereference in `pkt_sendmsg()`** | Kernel crash (CWE-476 / CWE-125) dereferencing `msg->msg_iov->iov_base` and `iov_len` before `pkt_sendmsg_is_valid()` is called when `msg_iovlen == 0` or `msg_iov == NULL`. | Safe: Deferred dereferencing until after `pkt_sendmsg_is_valid()` passes. | CWE-476 / CWE-125 | | **POSIX `[EMSGSIZE]` on `msg_iovlen <= 0 \|\| > IOV_MAX`** | Returned `-ENOTSUP`, violating POSIX specification. | Returns `-EMSGSIZE` when `msg_iovlen == 0 \|\| msg_iovlen > IOV_MAX`. Preserves `-ENOTSUP` only for `msg_iovlen > 1`. | POSIX IEEE Std 1003.1 `[EMSGSIZE]` | | **Missing Buffer Nullity Validation** | `msg_iov == NULL` or `iov_len > 0 && iov_base == NULL` was unchecked, risking segfault during buffer copy. | Returns `-EINVAL` immediately. | POSIX `[EINVAL]` | | **Missing `MSG_TRUNC` in `recvmsg()`** | Incoming packet payload truncated without setting `MSG_TRUNC` in `msg->msg_flags`. | Sets `MSG_TRUNC` in `msg->msg_flags` when buffer is smaller than payload. | POSIX `MSG_TRUNC` | | **`SOCK_DGRAM` Truncation Calculation** | Truncation compared against `dev->d_len` (which includes link-layer header), causing spurious `MSG_TRUNC` even when payload fit. | Strips link-layer header offset (`dev->d_len - NET_LL_HDRLEN(dev)`) before checking truncation for `SOCK_DGRAM`. | Protocol specification | ## Impact - Eliminates CWE-476 / CWE-125 kernel panic vectors on invalid/zero `msghdr` inputs in `net/pkt`. - Brings packet sockets into strict compliance with POSIX IEEE Std 1003.1. ## Testing ### 1. Coding Style Verification (`nxstyle`) All modified files verified with `nxstyle` with 0 errors and 0 warnings: ```text $ ./tools/nxstyle net/pkt/pkt_conn.c $ ./tools/nxstyle net/pkt/pkt_recvmsg.c $ ./tools/nxstyle net/pkt/pkt_sendmsg_buffered.c $ ./tools/nxstyle net/pkt/pkt_sendmsg_unbuffered.c # All checks passed with 0 errors, 0 warnings ``` ### 2. Build Verification (`sim:dynconns`) #### A. Unbuffered Packet Sendmsg (`CONFIG_NET_PKT=y`) Target build compiling `net/libnet.a`: ```text CC: pkt/pkt_sockif.c CC: pkt/pkt_conn.c CC: pkt/pkt_recvmsg.c CC: pkt/pkt_sendmsg_unbuffered.c CC: pkt/pkt_input.c CC: pkt/pkt_callback.c CC: pkt/pkt_poll.c CC: pkt/pkt_netpoll.c CC: pkt/pkt_finddev.c AR: net/libnet.a ``` Result: Build succeeded with 0 compiler errors and 0 warnings. #### B. Buffered Packet Sendmsg (`CONFIG_NET_PKT_WRITE_BUFFERS=y`) Target build compiling `net/libnet.a` with write buffering enabled: ```text CC: pkt/pkt_sockif.c CC: pkt/pkt_conn.c CC: pkt/pkt_recvmsg.c CC: pkt/pkt_sendmsg_buffered.c CC: pkt/pkt_input.c CC: pkt/pkt_callback.c CC: pkt/pkt_poll.c CC: pkt/pkt_netpoll.c CC: pkt/pkt_finddev.c AR: net/libnet.a ``` Result: Build succeeded with 0 compiler errors and 0 warnings. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
