Swatantra-66 opened a new pull request, #21538:
URL: https://github.com/apache/nuttx/pull/21538
## Summary
POSIX IEEE Std 1003.1 explicitly specifies for both `sendmsg()` and
`recvmsg()`:
> "[EMSGSIZE] The `msg_iovlen` member of the `msghdr` structure is less than
or equal to 0 or is greater than `{IOV_MAX}`."
In NuttX, `{IOV_MAX}` is defined in `<limits.h>` as `INT_MAX`. Because
`msg_iovlen` is an `unsigned long` in NuttX's `struct msghdr`, a value of `<=
0` corresponds to `msg_iovlen == 0`.
Neither `psock_sendmsg()` nor `psock_recvmsg()` previously validated
`msg->msg_iovlen`:
- In `psock_recvmsg()`, passing `msg_iovlen == 0` caused an out-of-bounds
dereference on `msg->msg_iov->iov_base` before returning `-EINVAL` instead of
the mandated `-EMSGSIZE`.
- In `net/usrsock` (`usrsock_sendmsg.c`), `struct iovec bufs[2 +
msg->msg_iovlen]` allocates a Variable-Length Array (VLA) directly on the
kernel stack, leading to kernel stack overflow if `msg_iovlen` is large.
- In `net/local` (`local_sendmsg.c`) and `net/rpmsg` (`rpmsg_sockif.c`),
missing top-level validation caused lower-level drivers to run 0-iteration
loops, send empty packet preambles, or reach undefined states.
- Because the top-level dispatchers omitted this check, several lower-level
drivers (`inet_sendmsg`, `inet_recvmsg`, `can_sendmsg`, `can_recvmsg`,
`local_recvmsg`) had to implement ad-hoc checks for `msg->msg_iovlen == 0`.
This change adds upfront validation of `msg->msg_iovlen` against `0` and
`IOV_MAX` in `psock_sendmsg()` and `psock_recvmsg()`, returning `-EMSGSIZE` on
violation, while ensuring `psock` is verified before dereferencing
`psock->s_type`.
Brings top-level vector boundary validation matching the iovec protections
merged in #21434 and #21492.
| Path / Scenario | Before This PR | With This PR | Standard / Impact |
| :--- | :--- | :--- | :--- |
| `sendmsg()` / `recvmsg()` with `msg_iovlen == 0` | Passes to lower driver,
returns `-EINVAL`, or dereferences empty array | Fails upfront with `-EMSGSIZE`
| POSIX IEEE Std 1003.1 compliance |
| `sendmsg()` / `recvmsg()` with `msg_iovlen > IOV_MAX` | Unbounded VLA on
kernel stack (`usrsock`), memory corruption | Fails upfront with `-EMSGSIZE` |
Prevents kernel stack overflow & OOB access |
| `psock == NULL` on entry | May dereference `psock->s_type` before checking
`psock` | Fails upfront with `-EBADF` | Prevents null pointer dereference |
## Impact
- **Security / Stability**: Eliminates kernel stack overflow risk from
unbounded VLAs in `usrsock` and prevents null/out-of-bounds array reads in
`recvmsg`.
- **POSIX Conformance**: Strictly enforces IEEE Std 1003.1 `[EMSGSIZE]`
requirement across all socket families (`inet`, `local`, `usrsock`, `rpmsg`,
`can`, `bluetooth`, `netlink`, `pkt`).
- **Compatibility**: No ABI change. Internal helpers (`send()`, `sendto()`,
`recv()`, `recvfrom()`) set `msg_iovlen = 1` and are completely unaffected.
## Testing
- **Coding Style**: Verified with `tools/nxstyle` on modified files (0
errors, 0 warnings).
- `net/socket/sendmsg.c`: 0 errors, 0 warnings
- `net/socket/recvmsg.c`: 0 errors, 0 warnings
- **Checkpatch**: Verified commit `ef37680ced` with `tools/checkpatch.sh -r
-K -m -g HEAD~1..HEAD` inside Docker:
```
✔️ All checks pass.
```
- **Logic Verification**: Confirmed that `msg->msg_iovlen == 0 ||
msg->msg_iovlen > IOV_MAX` returns `-EMSGSIZE`, and `psock` validation precedes
`psock->s_type` evaluation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
