Skip to content

fix(userspace/libsinsp/parsers): guard against invalid cmsg_len values#2768

Merged
poiana merged 1 commit intofalcosecurity:masterfrom
ekoops:ekoops/fix-ppm_cmsg_nxthdr
Jan 7, 2026
Merged

fix(userspace/libsinsp/parsers): guard against invalid cmsg_len values#2768
poiana merged 1 commit intofalcosecurity:masterfrom
ekoops:ekoops/fix-ppm_cmsg_nxthdr

Conversation

@ekoops
Copy link
Copy Markdown
Contributor

@ekoops ekoops commented Dec 23, 2025 •
edited
Loading

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

/kind sync

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR guards against invalid cmsg_len values while accessing control messages in ancillary data. This is achieved by checking there is enough space between the current control message and the end of the buffer to hold both the current control message and the next one.

This change sync the implementation of ppm_cmsg_nxthdr() with the current glibc implementation:
https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/cmsg_nxthdr.c;h=0e602a16053ed6742ea1556d75de8540e49157f1;hb=170550da27f68a08589e91b541883dcc58dee640

Which issue(s) this PR fixes:

Fixes #2765

Special notes for your reviewer:

/milestone 0.24.0

This also handles the case in #2764 . To understand why, let's analyze the scenario with the new implementation. In the following, I'm assuming sizeof(size_t) => 8, so sizeof(cmsghdr) => 16.

Given cmsg_len => 0xFFFFFFFFFFFFFFFF, then __CMSG_PADDING(cmsg_len) => 1, so size_needed => sizeof(size_t) + __CMSG_PADDING(cmsg_len) => 17.

Now, remaining_room is defined as the distance between the beginning of the current control message and the end of all control messages. It is defined in the following way:

const size_t remaining_room = static_cast<size_t>(msg_control + msg_controllen - reinterpret_cast<char *>(cmsg));

Notice that this value is positive, because cmsg is by construction a pointer laying on the region [msg_control, msg_control + msg_controllen].

We detect two failing cases:

  • remaining_room < size_needed - not important for this analysis
  • remaining_room - size_needed < cmsg_len - notice that this case is evaluated only if remaining_room >= size_needed; this means that must always be remaining_room - size_needed >= 0. For our analysis, here we have something positive < 0xFFFFFFFFFFFFFFFF, which is clearly true, preventing returning a non-NULL value

Hope this analysis helps reviewers.

Does this PR introduce a user-facing change?:

NONE

@poiana poiana added this to the 0.24.0 milestone Dec 23, 2025
@poiana poiana requested review from irozzo-1A and terror96 December 23, 2025 13:12
@ekoops
Copy link
Copy Markdown
Contributor Author

ekoops commented Dec 23, 2025

CC @fremmi , @deepskyblue86 , @terror96

@github-actions
Copy link
Copy Markdown

github-actions bot commented Dec 23, 2025 •
edited
Loading

Perf diff from master - unit tests

    16.92%     -6.91%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_add_ref_lock_nothrow()
     8.30%     +5.09%  [.] std::__shared_count<(__gnu_cxx::_Lock_policy)2>::_M_get_use_count() const
     6.74%     +2.85%  [.] sinsp_threadinfo::update_main_fdtable()
    13.30%     +2.23%  [.] std::__shared_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2>::__shared_ptr(std::__weak_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2> const&, std::nothrow_t)
     9.68%     -1.71%  [.] sinsp_threadinfo::get_fd_table()
    10.10%     -1.12%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release()
     3.73%     -0.26%  [.] sinsp_thread_manager::create_thread_dependencies(std::shared_ptr<sinsp_threadinfo> const&)
     5.03%     +0.16%  [.] thread_group_info::get_first_thread() const
     0.41%     -0.11%  [.] scap_event_encode_params_v
     6.46%     +0.10%  [.] std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count(std::__weak_count<(__gnu_cxx::_Lock_policy)2> const&, std::nothrow_t)

Heap diff from master - unit tests

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0114         -0.0112           239           236           239           236
BM_sinsp_split_median                                          -0.0130         -0.0130           239           236           239           236
BM_sinsp_split_stddev                                          -0.6551         -0.6478             2             1             2             1
BM_sinsp_split_cv                                              -0.6511         -0.6438             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0138         -0.0136            76            75            76            75
BM_sinsp_concatenate_paths_relative_path_median                -0.0212         -0.0210            76            75            76            75
BM_sinsp_concatenate_paths_relative_path_stddev                +0.0528         +0.0610             1             1             1             1
BM_sinsp_concatenate_paths_relative_path_cv                    +0.0675         +0.0757             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     +0.0746         +0.0746            41            45            41            45
BM_sinsp_concatenate_paths_empty_path_median                   +0.0503         +0.0503            42            44            42            44
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.1967         -0.1989             1             1             1             1
BM_sinsp_concatenate_paths_empty_path_cv                       -0.2525         -0.2545             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0145         +0.0145            74            75            74            75
BM_sinsp_concatenate_paths_absolute_path_median                +0.0139         +0.0139            74            75            74            75
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.8398         -0.8423             1             0             1             0
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.8421         -0.8446             0             0             0             0

@ekoops ekoops force-pushed the ekoops/fix-ppm_cmsg_nxthdr branch from b49f986 to cdf0efb Compare December 23, 2025 13:19
@codecov
Copy link
Copy Markdown

codecov bot commented Dec 23, 2025 •
edited
Loading

Codecov Report

❌ Patch coverage is 0% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 74.57%. Comparing base (9e6a8cc) to head (cc8428f).
⚠️ Report is 1 commits behind head on master.

Files with missing lines Patch % Lines
userspace/libsinsp/parsers.cpp 0.00% 6 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #2768      +/-   ##
==========================================
- Coverage   74.57%   74.57%   -0.01%     
==========================================
  Files         292      292              
  Lines       30026    30027       +1     
  Branches     4658     4656       -2     
==========================================
  Hits        22392    22392              
- Misses       7634     7635       +1
Flag Coverage Δ
libsinsp 74.57% <0.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

terror96
terror96 reviewed Dec 29, 2025
View reviewed changes
irozzo-1A
irozzo-1A previously approved these changes Jan 5, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@irozzo-1A irozzo-1A left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@poiana poiana added the lgtm label Jan 5, 2026
@ekoops
fix(userspace/libsinsp/parsers): guard against invalid cmsg_len values
cc8428f 
Guard against invalid `cmsg_len` values while accessing control
messages in ancillary data. This is achieved by checking there is
enough space between the current control message and the end of the
buffer to hold both the current control message and the next one.

This change sync the implementation of `ppm_cmsg_nxthdr()` with the
current glibc implementation:
https://sourceware.org/git/?p=glibc.git;a=blob;f=sysdeps/unix/sysv/linux/cmsg_nxthdr.c;h=0e602a16053ed6742ea1556d75de8540e49157f1;hb=170550da27f68a08589e91b541883dcc58dee640

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
@ekoops ekoops force-pushed the ekoops/fix-ppm_cmsg_nxthdr branch from cdf0efb to cc8428f Compare January 7, 2026 08:37
@ekoops ekoops requested review from irozzo-1A and terror96 January 7, 2026 08:37
irozzo-1A
irozzo-1A approved these changes Jan 7, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@irozzo-1A irozzo-1A left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

terror96
terror96 approved these changes Jan 7, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@terror96 terror96 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Jan 7, 2026
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Jan 7, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, irozzo-1A, terror96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 3f74fe7 into falcosecurity:master Jan 7, 2026
45 of 47 checks passed
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Jan 7, 2026
@ekoops ekoops deleted the ekoops/fix-ppm_cmsg_nxthdr branch January 7, 2026 18:05
@ekoops ekoops modified the milestones: 0.24.0, 0.23.1 Jan 14, 2026
@ekoops ekoops mentioned this pull request Jan 14, 2026
Merged
@BrewTestBot BrewTestBot mentioned this pull request Jan 14, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@terror96 terror96 terror96 approved these changes

@irozzo-1A irozzo-1A irozzo-1A approved these changes

Assignees

@terror96 terror96

@irozzo-1A irozzo-1A

Labels

approved area/libsinsp dco-signoff: yes kind/bug Something isn't working lgtm release-note-none size/S

Projects

Falco Roadmap
Status: Done

Milestone

0.23.1

Development

Successfully merging this pull request may close these issues.

Align ppm_cmsg_nxthdr with glibc __cmsg_nxthdr

4 participants

@ekoops @poiana @terror96 @irozzo-1A