Page MenuHomeFreeBSD

truss: Make control message header parsing more robust
ClosedPublic

Authored by markj on Jun 13 2022, 9:07 PM.
Tags
None
Referenced Files
F163567941: D35476.diff
Fri, Jul 24, 2:05 PM
Unknown Object (File)
Wed, Jul 22, 9:41 AM
Unknown Object (File)
Wed, Jul 15, 4:52 PM
Unknown Object (File)
Sat, Jul 11, 2:55 AM
Unknown Object (File)
Wed, Jul 8, 1:04 AM
Unknown Object (File)
May 3 2026, 4:14 PM
Unknown Object (File)
Apr 27 2026, 12:15 PM
Unknown Object (File)
Apr 27 2026, 6:06 AM
Subscribers

Details

Summary

print_cmsg() was assuming that the control message chain is well-formed,
but that isn't necessarily the case for sendmsg(2). In particular, if
cmsg_len is zero, print_cmsg() will loop forever. Check for truncated
headers and try to recover if possible.

Test Plan

This was found by running a syzkaller reproducer under truss. Now it prints:

94908: sendmsg(3,{NULL,0,0x0,0,{{level=SOL_SOCKET,type=SCM_RIGHTS,data={}}{<invalid cmsg len=0>}},108,0},0) ERR#22 'Invalid argument'

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 45963
Build 42851: arc lint + arc unit