CMSG_FIRSTHDR() returns NULL when recvmsg(2) did not receive any ancillary data, e.g. when the peer closed the socket without sending an FD. recv_fd() dereferences the result unconditionally and crashes instead of returning an error.
Return -EIO in that case. Assisted-by: LLM Signed-off-by: Günther Noack <[email protected]> --- tools/testing/selftests/landlock/common.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/landlock/common.h b/tools/testing/selftests/landlock/common.h index c5124de68a51..e195c0f48eb3 100644 --- a/tools/testing/selftests/landlock/common.h +++ b/tools/testing/selftests/landlock/common.h @@ -158,7 +158,7 @@ static int __maybe_unused recv_fd(int usock) return -errno; cmsg = CMSG_FIRSTHDR(&msg); - if (cmsg->cmsg_len != CMSG_LEN(sizeof(fd_rx))) + if (!cmsg || cmsg->cmsg_len != CMSG_LEN(sizeof(fd_rx))) return -EIO; memcpy(&fd_rx, CMSG_DATA(cmsg), sizeof(fd_rx)); -- 2.56.0
