Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Register
  • Sign in
  • NetworkManager NetworkManager
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 170
    • Issues 170
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 18
    • Merge requests 18
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar

Due to an influx of spam, we have had to impose restrictions on new accounts. Please see this wiki page for instructions on how to get full permissions. Sorry for the inconvenience.

  • NetworkManagerNetworkManager
  • NetworkManagerNetworkManager
  • Merge requests
  • !872

Draft: [th/platform-netlink-ctrunc] platform/netlink: don't reallocate ancillary data for recvmsg() on truncation

  • Review changes

  • Download
  • Email patches
  • Plain diff
Closed Thomas Haller requested to merge th/platform-netlink-ctrunc into main May 27, 2021
  • Overview 3
  • Commits 2
  • Pipelines 3
  • Changes 1

Coverity thinks there is a problem here:

    Error: TAINTED_SCALAR (CWE-20): [#def233]
    NetworkManager-1.31.5/src/libnm-platform/nm-netlink.c:1437: tainted_argument: Calling function "recvmsg" taints argument "msg".
    NetworkManager-1.31.5/src/libnm-platform/nm-netlink.c:1458: tainted_data: Passing tainted expression "msg.msg_controllen" to "g_realloc", which uses it as an allocation size.
    NetworkManager-1.31.5/src/libnm-platform/nm-netlink.c:1458: remediation: Ensure that tainted values are properly sanitized, by checking that their values are within a permissible range.
    # 1456|
    # 1457|           msg.msg_controllen *= 2;
    # 1458|->         msg.msg_control = g_realloc(msg.msg_control, msg.msg_controllen);
    # 1459|           goto retry;
    # 1460|       }

but the problem is not the tainted data. The problem is how should we handle MSG_CTRUNC? If we reach MSG_CTRUNC we already lost data. Retrying to receive the next message is not going to fix that and is plain wrong.

Also, there really is on need why any truncation should happen. The only ancillary data that should be present is the sender information, and for that our buffer is supposed to be large enough.

So, simply ignore truncation. It shouldn't happen, if it happened we cannot recover from it (aside failing an assertion), and all we really care are the retrieved credentials. If truncation happened, we might not have retrieved the credentials, but then that is for the caller to handle.

Assignee
Assign to
Reviewers
Request review from
Time tracking
Source branch: th/platform-netlink-ctrunc