casaroli opened a new pull request, #21337:
URL: https://github.com/apache/nuttx/pull/21337
## Summary
With more than one iovec, `inet_sendmsg()` adds the `iov_len` values in a
`size_t`, allocates a buffer of that size with `kmm_malloc()` and copies every
iovec into it. The sum is not checked: when it wraps, the buffer is too small
and `memcpy()` writes past its end.
`sendmsg()` now fails with `EINVAL` when the sum does not fit in an
`ssize_t`, as POSIX specifies ("The sum of the iov_len values overflows an
ssize_t") and as `uio_calc_resid()` already does for `readv()` and `writev()`.
## Impact
TCP and UDP `sendmsg()` with more than one iovec (`net/inet/inet_sockif.c`).
A sum that fits in an `ssize_t` gives the same result as before. Flat,
protected and kernel builds; all architectures (common code). Not a breaking
change. No documentation change: Documentation/ does not list the `sendmsg()`
errors.
## Testing
Base: master dde0b72332f. "master" in the results is this base.
Test program `sendmsg_iovsum.c` on a UDP socket and on a TCP connection over
the loopback device (`CONFIG_NET_LOOPBACK`), with `sendmsg()` to 127.0.0.1: (A)
two iovecs "hello " + "world", (D) one iovec, (C) iov_len `SSIZE_MAX` + 1, (B)
iov_len `SIZE_MAX` + 2 (the sum wraps to 1), then (A) again. QEMU with HVF:
| Configuration | master | this PR |
| --- | --- | --- |
| qemu-armv8a:knsh (kernel) | A, D pass; C: `ENOMEM`; B: data abort in the
kernel `memcpy()` of `inet_sendmsg()`, panic | A, D pass; B, C: `EINVAL`; A
again passes (10 of 10) |
| qemu-armv8a:nsh (flat) | A, D pass; C: `ENOMEM`; B: assertion in
`mm_malloc_size.c`, then a data abort | A, D pass; B, C: `EINVAL`; A again
passes (10 of 10) |
ostest exits with status 0 on qemu-armv8a:knsh and qemu-armv8a:nsh with this
PR.
lm3s6965-ek:qemu-flat and lm3s6965-ek:qemu-protected (32-bit, TCP and UDP)
build with `-Werror` and without warnings.
`tools/checkpatch.sh -c -u -m -g` passes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
