Swatantra-66 opened a new pull request, #21492:
URL: https://github.com/apache/nuttx/pull/21492
## Summary
Fixes two integer overflow bugs and two SCM (Socket Control Message)
descriptor handling bugs in Unix domain sockets (`net/local`):
1. **Datagram preamble integer wrap-around (`local_send_preamble`)**:
`pktlen` was accumulated into `lc_size_t` (`uint16_t` when
`CONFIG_DEV_PIPE_MAXSIZE <= 65535`). If the sum of `iov_len` values exceeded
65535, `pktlen` silently wrapped around modulo 65536 *before* checking against
`rcvsize`, allowing oversized datagrams to pass validation, write a truncated
packet length header, and corrupt FIFO packet framing. Now accumulates the
total in `size_t` and validates payload headroom before adding each buffer.
2. **Stream send 16-bit truncation (`local_send_packet`)**:
`sendlen` was typed `lc_size_t` (`uint16_t`). Stream socket writes
(`SOCK_STREAM`) larger than 64 KB wrapped around modulo 65536, returning a
bogus truncated byte count to userspace. Changed `sendlen` and function return
types to `ssize_t`.
3. **Zero-length send handling (`local_send_packet`)**:
Explicitly returns `0` when `len == 0` so empty datagrams (e.g.
heartbeat/ping) succeed and return 0 bytes instead of falling through to
`-EINVAL`.
4. **Dead error cleanup & descriptor leak (`local_sendmsg`)**:
The return value of `local_sendto()` / `local_send()` was assigned to
unsigned `size_t len`, rendering `if (len < 0 && count > 0)` dead code. Any
send failure leaked the control message file descriptors. Changed to signed
`ssize_t ret`.
5. **Orphaned SCM descriptors on zero-payload stream sends
(`local_sendmsg`)**:
On stream sockets (`SOCK_STREAM`), sending `SCM_RIGHTS` with 0 bytes of
payload queued descriptors, but wrote 0 bytes to the stream FIFO. The receiver
never woke up, leaving descriptors permanently orphaned in `lc_cfps` until
`lc_cfpcount` reached `LOCAL_NCONTROLFDS` (4) and broke future sends with
`-EMFILE`. Now rejects zero-data stream SCM sends with `-EINVAL`, strictly
conforming to POSIX / Linux `unix(7)` behavior (`if (scm && !total_len) return
-EINVAL;`).
## Impact
* **Impact on user:** Fixes silent packet corruption for datagrams > 64 KB,
fixes return value truncation for stream writes > 64 KB, and prevents SCM file
descriptor leaks in Unix domain sockets.
* **Impact on build:** None.
* **Impact on hardware:** None.
## Testing
* **Linters:** Verified locally against full CI checkpatch:
`./tools/checkpatch.sh -u -f net/local/local_sendpacket.c
net/local/local_sendmsg.c net/local/local.h` (exit code 0, all checks passed).
* **nxstyle:** Verified 0 errors and 0 warnings across all modified files.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
