On Thu, 14 Aug 2025, 13:53 , <ger...@altlinux.org> wrote:
> From: Denis Rastyogin <ger...@altlinux.org>
>
> fd_trans_target_to_host_data() in do_sendrecvmsg_locked() may be
> called when msg.msg_iov is NULL, for example when sending with
> MSG_MORE and no actual iovec data is present. Dereferencing
> msg.msg_iov in this case would lead to a NULL pointer access.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Reported-by: Alexey Appolonov <ale...@altlinux.org>
> Signed-off-by: Denis Rastyogin <ger...@altlinux.org>
> ---
> linux-user/syscall.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 59b2080b98..c7e6c53f08 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -3300,7 +3300,7 @@ static abi_long do_sendrecvmsg_locked(int fd, struct
> target_msghdr *msgp,
> msg.msg_iov = vec;
>
> if (send) {
> - if (fd_trans_target_to_host_data(fd)) {
> + if (fd_trans_target_to_host_data(fd) && msg.msg_iov->iov_len) {
>
Surely you meant ` && msg.msg_iov` instead of dereferencing the iov_len
field? According to the commit message.
void *host_msg;
>
> host_msg = g_malloc(msg.msg_iov->iov_len);
> --
> 2.42.2
>
>
>
