unix: sendmmsg and recvmsg have to cap a number of message to UIO_MAXIOV

Reported-by: syzbot+f2489ba0b999a45d1ad1@syzkaller.appspotmail.com
PiperOrigin-RevId: 358866218

pkg/sentry/syscalls/linux/sys_socket.go

@@ -657,6 +657,10 @@ func RecvMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 		return 0, nil, syserror.EINVAL
 	}
 
+	if vlen > linux.UIO_MAXIOV {
+		vlen = linux.UIO_MAXIOV
+	}
+
 	// Reject flags that we don't handle yet.
 	if flags & ^(baseRecvFlags|linux.MSG_CMSG_CLOEXEC|linux.MSG_ERRQUEUE) != 0 {
 		return 0, nil, syserror.EINVAL
@@ -938,6 +942,10 @@ func SendMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 		return 0, nil, syserror.EINVAL
 	}
 
+	if vlen > linux.UIO_MAXIOV {
+		vlen = linux.UIO_MAXIOV
+	}
+
 	// Get socket from the file descriptor.
 	file := t.GetFile(fd)
 	if file == nil {

pkg/sentry/syscalls/linux/vfs2/socket.go

@@ -660,6 +660,10 @@ func RecvMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 		return 0, nil, syserror.EINVAL
 	}
 
+	if vlen > linux.UIO_MAXIOV {
+		vlen = linux.UIO_MAXIOV
+	}
+
 	// Reject flags that we don't handle yet.
 	if flags & ^(baseRecvFlags|linux.MSG_CMSG_CLOEXEC|linux.MSG_ERRQUEUE) != 0 {
 		return 0, nil, syserror.EINVAL
@@ -941,6 +945,10 @@ func SendMMsg(t *kernel.Task, args arch.SyscallArguments) (uintptr, *kernel.Sysc
 		return 0, nil, syserror.EINVAL
 	}
 
+	if vlen > linux.UIO_MAXIOV {
+		vlen = linux.UIO_MAXIOV
+	}
+
 	// Get socket from the file descriptor.
 	file := t.GetFileVFS2(fd)
 	if file == nil {

test/syscalls/linux/BUILD

@@ -2305,7 +2305,7 @@ cc_library(
     name = "socket_generic_test_cases",
     testonly = 1,
     srcs = [
-        "socket_generic.cc",
+        "socket_generic_test_cases.cc",
     ],
     hdrs = [
         "socket_generic.h",

test/syscalls/linux/socket_generic_test_cases.cc

@@ -98,6 +98,27 @@ TEST_P(AllSocketPairTest, BasicSendmmsg) {
   EXPECT_EQ(0, memcmp(sent_data, received_data, sizeof(sent_data)));
 }
 
+TEST_P(AllSocketPairTest, SendmmsgIsLimitedByMAXIOV) {
+  std::unique_ptr<SocketPair> sockets =
+      ASSERT_NO_ERRNO_AND_VALUE(NewSocketPair());
+  char c = 0;
+
+  std::vector<struct mmsghdr> msgs(UIO_MAXIOV + 1);
+  std::vector<struct iovec> iovs(msgs.size());
+  for (size_t i = 0; i < msgs.size(); i++) {
+    iovs[i].iov_len = 1;
+    iovs[i].iov_base = &c;
+    msgs[i].msg_hdr.msg_iov = &iovs[i];
+    msgs[i].msg_hdr.msg_iovlen = 1;
+  }
+
+  int n;
+  ASSERT_THAT(n = RetryEINTR(sendmmsg)(sockets->first_fd(), msgs.data(),
+                                       msgs.size(), MSG_DONTWAIT),
+              SyscallSucceeds());
+  EXPECT_LE(n, UIO_MAXIOV);
+}
+
 TEST_P(AllSocketPairTest, BasicRecvmmsg) {
   auto sockets = ASSERT_NO_ERRNO_AND_VALUE(NewSocketPair());
   char sent_data[200];