Fix panic when parsing SO_TIMESTAMP cmsg

PiperOrigin-RevId: 350223482

5 files changed, 80 insertions, 9 deletions

diff --git a/pkg/sentry/socket/control/BUILD b/pkg/sentry/socket/control/BUILD
index fb7c5dc61..ebcc891b3 100644
--- a/pkg/sentry/socket/control/BUILD
+++ b/pkg/sentry/socket/control/BUILD
@@ -1,4 +1,4 @@
-load("//tools:defs.bzl", "go_library")
+load("//tools:defs.bzl", "go_library", "go_test")
 
 package(licenses = ["notice"])
 
@@ -26,3 +26,17 @@ go_library(
         "//pkg/usermem",
     ],
 )
+
+go_test(
+    name = "control_test",
+    size = "small",
+    srcs = ["control_test.go"],
+    library = ":control",
+    deps = [
+        "//pkg/abi/linux",
+        "//pkg/binary",
+        "//pkg/sentry/socket",
+        "//pkg/usermem",
+        "@com_github_google_go_cmp//cmp:go_default_library",
+    ],
+)
diff --git a/pkg/sentry/socket/control/control.go b/pkg/sentry/socket/control/control.go
index ff6b71802..65b556489 100644
--- a/pkg/sentry/socket/control/control.go
+++ b/pkg/sentry/socket/control/control.go
@@ -463,7 +463,7 @@ func CmsgsSpace(t *kernel.Task, cmsgs socket.ControlMessages) int {
 }
 
 // Parse parses a raw socket control message into portable objects.
-func Parse(t *kernel.Task, socketOrEndpoint interface{}, buf []byte) (socket.ControlMessages, error) {
+func Parse(t *kernel.Task, socketOrEndpoint interface{}, buf []byte, width uint) (socket.ControlMessages, error) {
 	var (
 		cmsgs socket.ControlMessages
 		fds   linux.ControlMessageRights
@@ -487,10 +487,6 @@ func Parse(t *kernel.Task, socketOrEndpoint interface{}, buf []byte) (socket.Con
 		i += linux.SizeOfControlMessageHeader
 		length := int(h.Length) - linux.SizeOfControlMessageHeader
 
-		// The use of t.Arch().Width() is analogous to Linux's use of
-		// sizeof(long) in CMSG_ALIGN.
-		width := t.Arch().Width()
-
 		switch h.Level {
 		case linux.SOL_SOCKET:
 			switch h.Type {
@@ -526,8 +522,10 @@ func Parse(t *kernel.Task, socketOrEndpoint interface{}, buf []byte) (socket.Con
 				if length < linux.SizeOfTimeval {
 					return socket.ControlMessages{}, syserror.EINVAL
 				}
+				var ts linux.Timeval
+				binary.Unmarshal(buf[i:i+linux.SizeOfTimeval], usermem.ByteOrder, &ts)
+				cmsgs.IP.Timestamp = ts.ToNsecCapped()
 				cmsgs.IP.HasTimestamp = true
-				binary.Unmarshal(buf[i:i+linux.SizeOfTimeval], usermem.ByteOrder, &cmsgs.IP.Timestamp)
 				i += binary.AlignUp(length, width)
 
 			default:
diff --git a/pkg/sentry/socket/control/control_test.go b/pkg/sentry/socket/control/control_test.go
new file mode 100644
index 000000000..d40a4cc85
--- /dev/null
+++ b/pkg/sentry/socket/control/control_test.go
@@ -0,0 +1,59 @@
+// Copyright 2020 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package control provides internal representations of socket control
+// messages.
+package control
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"gvisor.dev/gvisor/pkg/abi/linux"
+	"gvisor.dev/gvisor/pkg/binary"
+	"gvisor.dev/gvisor/pkg/sentry/socket"
+	"gvisor.dev/gvisor/pkg/usermem"
+)
+
+func TestParse(t *testing.T) {
+	// Craft the control message to parse.
+	length := linux.SizeOfControlMessageHeader + linux.SizeOfTimeval
+	hdr := linux.ControlMessageHeader{
+		Length: uint64(length),
+		Level:  linux.SOL_SOCKET,
+		Type:   linux.SO_TIMESTAMP,
+	}
+	buf := make([]byte, 0, length)
+	buf = binary.Marshal(buf, usermem.ByteOrder, &hdr)
+	ts := linux.Timeval{
+		Sec:  2401,
+		Usec: 343,
+	}
+	buf = binary.Marshal(buf, usermem.ByteOrder, &ts)
+
+	cmsg, err := Parse(nil, nil, buf, 8 /* width */)
+	if err != nil {
+		t.Fatalf("Parse(_, _, %+v, _): %v", cmsg, err)
+	}
+
+	want := socket.ControlMessages{
+		IP: socket.IPControlMessages{
+			HasTimestamp: true,
+			Timestamp:    ts.ToNsecCapped(),
+		},
+	}
+	if diff := cmp.Diff(want, cmsg); diff != "" {
+		t.Errorf("unexpected message parsed, (-want, +got):\n%s", diff)
+	}
+}
diff --git a/pkg/sentry/syscalls/linux/sys_socket.go b/pkg/sentry/syscalls/linux/sys_socket.go
index 4adfa6637..fe45225c1 100644
--- a/pkg/sentry/syscalls/linux/sys_socket.go
+++ b/pkg/sentry/syscalls/linux/sys_socket.go
@@ -1030,7 +1030,7 @@ func sendSingleMsg(t *kernel.Task, s socket.Socket, file *fs.File, msgPtr userme
 		return 0, err
 	}
 
-	controlMessages, err := control.Parse(t, s, controlData)
+	controlMessages, err := control.Parse(t, s, controlData, t.Arch().Width())
 	if err != nil {
 		return 0, err
 	}
diff --git a/pkg/sentry/syscalls/linux/vfs2/socket.go b/pkg/sentry/syscalls/linux/vfs2/socket.go
index 987012acc..f5795b4a8 100644
--- a/pkg/sentry/syscalls/linux/vfs2/socket.go
+++ b/pkg/sentry/syscalls/linux/vfs2/socket.go
@@ -1033,7 +1033,7 @@ func sendSingleMsg(t *kernel.Task, s socket.SocketVFS2, file *vfs.FileDescriptio
 		return 0, err
 	}
 
-	controlMessages, err := control.Parse(t, s, controlData)
+	controlMessages, err := control.Parse(t, s, controlData, t.Arch().Width())
 	if err != nil {
 		return 0, err
 	}