fix(userspace/libsinsp/parsers): guard against invalid cmsg_len values #2768
+15
−9
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Guard against invalid `cmsg_len` values while accessing control messages in ancillary data. This is achieved by checking there is enough space between the current control message and the end of the buffer to hold both the current control message and the next one. This change sync the implementation of `ppm_cmsg_nxthdr()` with the current glibc implementation: https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/cmsg_nxthdr.c;h=0e602a16053ed6742ea1556d75de8540e49157f1;hb=170550da27f68a08589e91b541883dcc58dee640 Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ekoops The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Contributor
Author
|
CC @fremmi , @deepskyblue86 , @terror96 |
Perf diff from master - unit testsHeap diff from master - unit testsHeap diff from master - scap fileBenchmarks diff from master |
ekoops
force-pushed
the
ekoops/fix-ppm_cmsg_nxthdr
branch
from
b49f986 to
cdf0efb
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #2768 +/- ##
==========================================
- Coverage 74.57% 74.57% -0.01%
==========================================
Files 292 292
Lines 30026 30027 +1
Branches 4658 4656 -2
==========================================
Hits 22392 22392
- Misses 7634 7635 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
terror96
reviewed
Dec 29, 2025
| cmsg = reinterpret_cast<ppm_cmsghdr *>(reinterpret_cast<char *>(cmsg) + cmsg_aligned_len); | ||
| if(reinterpret_cast<char *>(cmsg + 1) > msg_control + msg_controllen || | ||
| reinterpret_cast<char *>(cmsg) + cmsg_aligned_len > msg_control + msg_controllen) { | ||
| // There isn't enough space between cmsg and the end of the buffer to hold the current cmsg |
Contributor
There was a problem hiding this comment.
Suggested change
| // There isn't enough space between cmsg and the end of the buffer to hold the current cmsg | |
| // Check that there is enough space between cmsg and the end of the buffer to hold the current cmsg |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
/kind bug
Any specific area of the project related to this PR?
/area libsinsp
Does this PR require a change in the driver versions?
What this PR does / why we need it:
This PR guards against invalid
cmsg_lenvalues while accessing control messages in ancillary data. This is achieved by checking there is enough space between the current control message and the end of the buffer to hold both the current control message and the next one.This change sync the implementation of
ppm_cmsg_nxthdr()with the current glibc implementation:https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/cmsg_nxthdr.c;h=0e602a16053ed6742ea1556d75de8540e49157f1;hb=170550da27f68a08589e91b541883dcc58dee640
Which issue(s) this PR fixes:
Fixes #2765
Special notes for your reviewer:
/milestone 0.24.0
This also handles the case in #2764 . To understand why, let's analyze the scenario with the new implementation. In the following, I'm assuming
sizeof(size_t) => 8, sosizeof(cmsghdr) => 16.Given
cmsg_len => 0xFFFFFFFFFFFFFFFF, then__CMSG_PADDING(cmsg_len) => 1, sosize_needed => sizeof(size_t) + __CMSG_PADDING(cmsg_len) => 17.Now,
remaining_roomis defined as the distance between the beginning of the current control message and the end of all control messages. It is defined in the following way:Notice that this value is positive, because
cmsgis by construction a pointer laying on the region[msg_control, msg_control + msg_controllen].We detect two failing cases:
remaining_room < size_needed- not important for this analysisremaining_room - size_needed < cmsg_len- notice that this case is evaluated only ifremaining_room >= size_needed; this means that must always beremaining_room - size_needed >= 0. For our analysis, here we havesomething positive < 0xFFFFFFFFFFFFFFFF, which is clearly true, preventing returning a non-NULL valueHope this analysis helps reviewers.
Does this PR introduce a user-facing change?: