syd 3.52.0

// Syd: rock-solid application kernel
// src/kernel/net/recvmsg.rs: recvmsg(2), recvmmsg(2), and recvmmsg_time64 handlers
//
// Copyright (c) 2025, 2026 Ali Polatel <alip@chesswob.org>
//
// SPDX-License-Identifier: GPL-3.0

use std::os::fd::AsFd;

use libc::{c_int, c_uint, c_void, iovec, sockaddr, socklen_t, MSG_CTRUNC};
use libseccomp::ScmpNotifResp;
use nix::{
    errno::Errno,
    sys::socket::{SockaddrLike, SockaddrStorage},
};
use zeroize::Zeroizing;

use crate::{
    compat::{
        mmsghdr, mmsghdr32, msghdr, msghdr32, recvmmsg, recvmsg, try_from_bytes, MmsgHdr, MsgFlags,
        TimeSpec32, TimeSpec64, ToByteArray, UIO_MAXIOV,
    },
    confine::scmp_arch_is_compat32,
    fd::{fd_inode, get_nonblock, has_recv_timeout, SafeOwnedFd},
    kernel::net::to_msgflags,
    req::UNotifyEventRequest,
    sandbox::{Flags, Options},
    unix::unix_addr_len,
};

pub(crate) fn handle_recvmsg(
    fd: SafeOwnedFd,
    request: &UNotifyEventRequest,
    args: &[u64; 6],
    flags: Flags,
    options: Options,
) -> Result<ScmpNotifResp, Errno> {
    // Truncate flags to 32-bit keeping unknown flags.
    let call_flags = to_msgflags(args[2]);

    // Reject MSG_OOB as necessary.
    if !options.allow_unsafe_oob() && call_flags.contains(MsgFlags::MSG_OOB) {
        // Signal no support to let the sandbox process handle the error
        // gracefully. This is consistent with the Linux kernel.
        return Err(Errno::EOPNOTSUPP);
    }

    // Determine bitness of sandbox process.
    let req = request.scmpreq;
    let is32 = scmp_arch_is_compat32(req.data.arch);

    // Linux rejects MSG_CMSG_COMPAT on 64-bit.
    if !is32 && call_flags.contains(MsgFlags::MSG_CMSG_COMPAT) {
        return Err(Errno::EINVAL);
    }

    // Read user msghdr.
    let hdr_sz = if is32 {
        size_of::<msghdr32>()
    } else {
        size_of::<msghdr>()
    };

    let hdr = request.read_vec_all_zeroed(args[1], hdr_sz)?;
    let mut hdr: msghdr = if is32 {
        let m32: msghdr32 = try_from_bytes(&hdr)?;
        msghdr::from(m32)
    } else {
        try_from_bytes(&hdr)?
    };

    // Mirror sandbox process iovecs to local, bounded buffers.
    #[expect(clippy::type_complexity)]
    let mut msg_bufs: Vec<(Zeroizing<Vec<u8>>, u64)> = Vec::new();
    let mut msg_iovs: Vec<iovec> = Vec::new();
    let mut nam_buf: Vec<u8> = Vec::new();
    let mut ctl_buf: Vec<u8> = Vec::new();

    // Handle msg_name.
    let (user_nam_base, user_nam_size) = request.setup_msghdr_name(&mut hdr, &mut nam_buf)?;

    // Handle msg_iov.
    let user_iov_base = request.read_msghdr_iov(&mut hdr, &mut msg_bufs, &mut msg_iovs)?;

    // Handle msg_control.
    let (user_ctl_base, user_ctl_size) = request.setup_msghdr_ctl(&mut hdr, &mut ctl_buf)?;

    // Track blocking call for invalidation semantics.
    let is_blocking = !call_flags.contains(MsgFlags::MSG_DONTWAIT) && !get_nonblock(&fd)?;
    let ignore_restart = if is_blocking {
        has_recv_timeout(&fd)?
    } else {
        false
    };
    if is_blocking {
        request.cache.add_sys_block(req, ignore_restart)?;
    }

    // Perform recvmsg(2).
    let result = recvmsg(&fd, hdr.as_mut(), call_flags);

    // Remove invalidation record.
    if is_blocking {
        request.cache.del_sys_block(req.id)?;
    }

    // Check result after critical block.
    let r_bytes = result?.bytes;

    // Scatter payload back into the sandbox process.
    scatter_iov(request, r_bytes, &msg_bufs)?;

    // Handle peer address logic.
    //
    // Linux rejects negative values for msg_namelen.
    let namelen: socklen_t = socklen_t::try_from(hdr.msg_namelen).or(Err(Errno::EINVAL))?;
    let (namelen_out, addr_bytes) = prepare_addr(&fd, request, hdr.msg_name, namelen)?;
    hdr.msg_namelen = c_int::try_from(namelen_out).or(Err(Errno::EINVAL))?;

    // Handle control messages.
    //
    // Pass unsupported control messages unchanged.
    if !hdr.msg_control.is_null() && hdr.msg_controllen > 0 {
        // SAFETY: msg_control points to a locally allocated buffer checked above.
        let cmsg_buf =
            unsafe { std::slice::from_raw_parts(hdr.msg_control as *const u8, hdr.msg_controllen) };
        let close_on_exec =
            flags.force_cloexec() || call_flags.contains(MsgFlags::MSG_CMSG_CLOEXEC);
        let rand_fd = flags.force_rand_fd();

        let (cmsgs, cmsgs_truncated) =
            request.fixup_cmsgs(&fd, cmsg_buf, user_ctl_size, close_on_exec, rand_fd)?;
        let (cmsg_len, truncated) = request.write_cmsgs(&cmsgs, user_ctl_base, user_ctl_size)?;
        if truncated || cmsgs_truncated {
            hdr.msg_flags |= MSG_CTRUNC as c_uint;
        }
        hdr.msg_controllen = cmsg_len;
    } else {
        hdr.msg_controllen = 0;
    }

    // Replace local pointers with sandbox process pointers.
    hdr.msg_iov = user_iov_base as *mut iovec;
    hdr.msg_name = user_nam_base as *mut c_void;
    hdr.msg_control = user_ctl_base as *mut c_void;

    // Write-back msghdr handling 32-bit as necessary.
    if is32 {
        let m32: msghdr32 = hdr.try_into()?;
        let buf: [u8; size_of::<msghdr32>()] = m32.to_byte_array();
        request.write_mem_all(&buf, args[1])?;
    } else {
        let buf: [u8; size_of::<msghdr>()] = hdr.to_byte_array();
        request.write_mem_all(&buf, args[1])?;
    }

    // Linux writes message name length before address.
    if let Some(bytes) = addr_bytes {
        #[expect(clippy::cast_possible_truncation)]
        let out_len = (namelen_out.min(user_nam_size as socklen_t)) as usize;
        request.write_mem_all(&bytes[..out_len], user_nam_base)?;
    }

    // Return number of payload bytes received.
    #[expect(clippy::cast_possible_wrap)]
    Ok(request.return_syscall(r_bytes as i64))
}

pub(crate) fn handle_recvmmsg(
    fd: SafeOwnedFd,
    request: &UNotifyEventRequest,
    args: &[u64; 6],
    flags: Flags,
    options: Options,
) -> Result<ScmpNotifResp, Errno> {
    // Determine if the process is 32-bit or 64-bit.
    let is32 = scmp_arch_is_compat32(request.scmpreq.data.arch);

    // Read the timespec structure for timeout (32-bit or 64-bit).
    let timeout = if args[4] != 0 {
        if is32 {
            // Read TimeSpec32 if the process is 32-bit.
            Some(request.remote_timespec32(args[4])?)
        } else {
            // Read TimeSpec64 if the process is 64-bit.
            Some(request.remote_timespec64(args[4])?)
        }
    } else {
        None
    };

    // Pass the timeout to the internal function.
    do_recvmmsg(fd, request, args, flags, options, timeout, is32)
}

pub(crate) fn handle_recvmmsg64(
    fd: SafeOwnedFd,
    request: &UNotifyEventRequest,
    args: &[u64; 6],
    flags: Flags,
    options: Options,
) -> Result<ScmpNotifResp, Errno> {
    // Read the timespec structure for timeout (explicit 64-bit).
    let timeout = if args[4] != 0 {
        Some(request.remote_timespec64(args[4])?)
    } else {
        None
    };

    // Pass the timeout to the internal function.
    do_recvmmsg(
        fd, request, args, flags, options, timeout, false, /*is32*/
    )
}

// Helper to handle both recvmmsg(2) and recvmmsg_time64(2) syscalls.
fn do_recvmmsg<Fd: AsFd>(
    fd: Fd,
    request: &UNotifyEventRequest,
    args: &[u64; 6],
    flags: Flags,
    options: Options,
    mut timeout: Option<TimeSpec64>,
    timeout_is32: bool,
) -> Result<ScmpNotifResp, Errno> {
    // Truncate flags to 32-bit keeping unknown flags.
    let call_flags = to_msgflags(args[3]);

    // Reject MSG_OOB as necessary.
    if !options.allow_unsafe_oob() && call_flags.contains(MsgFlags::MSG_OOB) {
        // Signal no support to let the sandbox process handle the error
        // gracefully. This is consistent with the Linux kernel.
        return Err(Errno::EOPNOTSUPP);
    }

    // Determine bitness of sandbox process.
    let req = request.scmpreq;
    let is32 = scmp_arch_is_compat32(req.data.arch);

    // Linux rejects MSG_CMSG_COMPAT on 64-bit.
    if !is32 && call_flags.contains(MsgFlags::MSG_CMSG_COMPAT) {
        return Err(Errno::EINVAL);
    }

    // Read the user mmsghdr array.
    //
    // Linux truncates message count to unsigned int. Cap at IOV_MAX.
    #[expect(clippy::cast_possible_truncation)]
    let msg_count = (args[2] as c_uint as usize).min(UIO_MAXIOV);
    let msgs_offset = args[1];

    // Preallocate memory for mmsghdr array.
    let hdr_sz = if is32 {
        size_of::<mmsghdr32>()
    } else {
        size_of::<mmsghdr>()
    };
    let total_sz = hdr_sz.checked_mul(msg_count).ok_or(Errno::EOVERFLOW)?;
    let hdr = request.read_vec_all_zeroed(msgs_offset, total_sz)?;

    // Convert to native format to pass to recvmmsg(2).
    let mut msgs = Vec::new();
    #[expect(clippy::type_complexity)]
    let mut msg_bufs: Vec<Option<Vec<(Zeroizing<Vec<u8>>, u64)>>> = Vec::new();
    let mut nam_bufs: Vec<Option<Vec<u8>>> = Vec::new();
    let mut ctl_bufs: Vec<Option<Vec<u8>>> = Vec::new();
    let mut msg_iovs: Vec<Vec<iovec>> = Vec::new();
    let mut user_iov_bases: Vec<Option<u64>> = Vec::new();
    let mut user_nam_bases: Vec<Option<(u64, usize)>> = Vec::new();
    let mut user_ctl_bases: Vec<Option<(u64, usize)>> = Vec::new();
    msgs.try_reserve(msg_count).or(Err(Errno::ENOMEM))?;
    msg_bufs.try_reserve(msg_count).or(Err(Errno::ENOMEM))?;
    nam_bufs.try_reserve(msg_count).or(Err(Errno::ENOMEM))?;
    ctl_bufs.try_reserve(msg_count).or(Err(Errno::ENOMEM))?;
    msg_iovs.try_reserve(msg_count).or(Err(Errno::ENOMEM))?;
    user_iov_bases
        .try_reserve(msg_count)
        .or(Err(Errno::ENOMEM))?;
    user_nam_bases
        .try_reserve(msg_count)
        .or(Err(Errno::ENOMEM))?;
    user_ctl_bases
        .try_reserve(msg_count)
        .or(Err(Errno::ENOMEM))?;

    for chunk in hdr.chunks(hdr_sz) {
        let inner: libc::mmsghdr = if is32 {
            let m32: mmsghdr32 = try_from_bytes(chunk)?;
            mmsghdr::from(m32).into()
        } else {
            let m64: mmsghdr = try_from_bytes(chunk)?;
            m64.into()
        };
        let mut mmhdr = MmsgHdr::from_raw(inner);

        // Handle hdr.msg_name.
        request.setup_mmsghdr_name(mmhdr.as_inner_mut(), &mut nam_bufs, &mut user_nam_bases)?;

        // Handle hdr.msg_iov.
        request.read_mmsghdr_iov(
            mmhdr.as_inner_mut(),
            &mut msg_bufs,
            &mut msg_iovs,
            &mut user_iov_bases,
        )?;

        // Handle hdr.msg_control.
        request.setup_mmsghdr_ctl(mmhdr.as_inner_mut(), &mut ctl_bufs, &mut user_ctl_bases)?;

        msgs.push(mmhdr);
    }

    // Track blocking call for invalidation semantics.
    let is_blocking = !call_flags.contains(MsgFlags::MSG_DONTWAIT) && !get_nonblock(&fd)?;
    let ignore_restart = if is_blocking {
        timeout.is_some() || has_recv_timeout(&fd)?
    } else {
        false
    };
    if is_blocking {
        request.cache.add_sys_block(req, ignore_restart)?;
    }

    // Perform recvmmsg(2).
    let result = recvmmsg(&fd, &mut msgs[..msg_count], call_flags, timeout.as_mut());

    // Remove invalidation record.
    if is_blocking {
        request.cache.del_sys_block(req.id)?;
    }

    // Check result after critical block.
    let msg_count = result?;

    // Iterate over raw mmsghdr results.
    //
    // Linux returns number of processed messages when a later iteration fails.
    let ctx = MmsgRecv {
        fd: &fd,
        request,
        flags,
        call_flags,
        is32,
        msgs_offset,
    };
    let mut nmsgs: usize = 0;
    #[expect(clippy::needless_range_loop)]
    for idx in 0..msg_count {
        match ctx.write_one(
            &mut msgs[idx],
            msg_bufs.get(idx).and_then(Option::as_ref),
            user_iov_bases.get(idx).copied().flatten(),
            user_nam_bases.get(idx).copied().flatten(),
            user_ctl_bases.get(idx).copied().flatten(),
            idx,
        ) {
            Ok(()) => nmsgs = nmsgs.checked_add(1).ok_or(Errno::EOVERFLOW)?,
            Err(_) if nmsgs > 0 => break,
            Err(errno) => return Err(errno),
        }
    }

    // Write updated timeout back to sandbox process memory.
    if nmsgs > 0 {
        if let Some(timeout) = timeout {
            let addr = args[4];
            if timeout_is32 {
                let t32: TimeSpec32 = timeout.try_into()?;
                let buf: [u8; size_of::<TimeSpec32>()] = t32.to_byte_array();
                request.write_mem_all(&buf, addr)?;
            } else {
                let buf: [u8; size_of::<TimeSpec64>()] = timeout.to_byte_array();
                request.write_mem_all(&buf, addr)?;
            }
        }
    }

    // Return number of messages received.
    #[expect(clippy::cast_possible_wrap)]
    Ok(request.return_syscall(nmsgs as i64))
}

// Scatter received iov payload back into the sandbox process memory.
#[expect(clippy::type_complexity)]
fn scatter_iov(
    request: &UNotifyEventRequest,
    bytes: usize,
    bufs: &[(Zeroizing<Vec<u8>>, u64)],
) -> Result<(), Errno> {
    if bytes > 0 {
        let mut remaining = bytes;
        for (buf, ptr) in bufs {
            if remaining == 0 {
                break;
            }
            let take = remaining.min(buf.len());
            request.write_mem_all(&buf[..take], *ptr)?;
            remaining = remaining.checked_sub(take).ok_or(Errno::EOVERFLOW)?;
        }
    }
    Ok(())
}

// Resolve peer address from a kernel-returned msghdr.
//
// Returns new "msg_namelen" value and address bytes to copy.
#[expect(clippy::type_complexity)]
fn prepare_addr<Fd: AsFd>(
    fd: Fd,
    request: &UNotifyEventRequest,
    msg_name: *mut c_void,
    msg_namelen: socklen_t,
) -> Result<(socklen_t, Option<Vec<u8>>), Errno> {
    let r_addr = if !msg_name.is_null() && msg_namelen > 0 {
        // SAFETY: msg_name and msg_namelen are from a kernel-returned msghdr.
        unsafe { SockaddrStorage::from_raw(msg_name as *const sockaddr, Some(msg_namelen)) }
    } else {
        None
    };

    if let Some(mut addr) = r_addr {
        let hdr_namelen = if let Ok(ino) = fd_inode(fd) {
            if let Ok(peer_addr) = request.resolve_unix_peer(&addr, ino) {
                addr = peer_addr;
                addr.as_unix_addr().map_or(addr.len(), unix_addr_len)
            } else {
                msg_namelen
            }
        } else {
            msg_namelen
        };

        // SAFETY: SockaddrStorage is initialized; as_ptr() and len() return valid bounds.
        let buf =
            unsafe { std::slice::from_raw_parts(addr.as_ptr().cast::<u8>(), addr.len() as usize) };

        let namelen_out = addr.len().min(hdr_namelen);
        let mut bytes: Vec<u8> = Vec::new();
        bytes.try_reserve(buf.len()).or(Err(Errno::ENOMEM))?;
        bytes.extend_from_slice(buf);
        Ok((namelen_out, Some(bytes)))
    } else {
        Ok((0, None))
    }
}

// Loop-invariant context for writing recvmmsg(2) results back to
// sandbox process memory.
struct MmsgRecv<'a, Fd: AsFd> {
    fd: &'a Fd,
    request: &'a UNotifyEventRequest,
    flags: Flags,
    call_flags: MsgFlags,
    is32: bool,
    msgs_offset: u64,
}

impl<Fd: AsFd> MmsgRecv<'_, Fd> {
    // Write one received mmsghdr (payload, peer address, control
    // messages, header) to sandbox process memory.
    #[expect(clippy::type_complexity)]
    fn write_one(
        &self,
        mmsg_hdr: &mut MmsgHdr,
        msg_bufs: Option<&Vec<(Zeroizing<Vec<u8>>, u64)>>,
        user_iov_base: Option<u64>,
        user_nam_base: Option<(u64, usize)>,
        user_ctl_base: Option<(u64, usize)>,
        idx: usize,
    ) -> Result<(), Errno> {
        let inner = mmsg_hdr.as_inner_mut();

        // Replace msg_iov pointer with sandbox process pointer.
        if let Some(iov_ptr) = user_iov_base {
            inner.msg_hdr.msg_iov = iov_ptr as *mut iovec;
        }

        // Scatter payload back into sandbox process.
        if let Some(bufs) = msg_bufs {
            scatter_iov(self.request, inner.msg_len as usize, bufs)?;
        }

        // Handle peer address logic.
        let nam_write = if let Some((nam_ptr, nam_len)) = user_nam_base {
            let (namelen_out, addr_bytes) = prepare_addr(
                self.fd,
                self.request,
                inner.msg_hdr.msg_name,
                inner.msg_hdr.msg_namelen,
            )?;
            inner.msg_hdr.msg_namelen = namelen_out;
            inner.msg_hdr.msg_name = nam_ptr as *mut c_void;
            addr_bytes.map(|b| (b, nam_ptr, nam_len, namelen_out))
        } else {
            None
        };

        // Handle SCM_PIDFD, SCM_RIGHTS, SCM_CREDENTIALS, and 32-bit
        // timestamp conversions in the control message. Pass other
        // control messages unchanged.
        #[expect(clippy::disallowed_methods)]
        #[expect(clippy::useless_conversion)]
        if let Some((ctl_ptr, ctl_len)) = user_ctl_base {
            if !inner.msg_hdr.msg_control.is_null() && inner.msg_hdr.msg_controllen > 0 {
                // SAFETY: msg_control points to a locally allocated buffer checked above.
                #[expect(clippy::unnecessary_cast)]
                let cmsg_buf = unsafe {
                    std::slice::from_raw_parts(
                        inner.msg_hdr.msg_control as *const u8,
                        inner.msg_hdr.msg_controllen as usize,
                    )
                };
                let close_on_exec = self.flags.force_cloexec()
                    || self.call_flags.contains(MsgFlags::MSG_CMSG_CLOEXEC);
                let rand_fd = self.flags.force_rand_fd();

                let (cmsgs, cmsgs_truncated) =
                    self.request
                        .fixup_cmsgs(self.fd, cmsg_buf, ctl_len, close_on_exec, rand_fd)?;
                let (cmsg_len, truncated) = self.request.write_cmsgs(&cmsgs, ctl_ptr, ctl_len)?;
                if truncated || cmsgs_truncated {
                    inner.msg_hdr.msg_flags |= MsgFlags::MSG_CTRUNC.bits();
                }

                inner.msg_hdr.msg_control = ctl_ptr as *mut c_void;
                // unwrap is for musl compat.
                inner.msg_hdr.msg_controllen = cmsg_len.try_into().unwrap();
            } else {
                inner.msg_hdr.msg_controllen = 0;
            }
        } else {
            inner.msg_hdr.msg_controllen = 0;
        }

        // Write back mmsghdr for each result in the array.
        let msg_header = mmsg_hdr.to_msg_bytes(self.is32)?;

        let msg_header_size = msg_header.len() as u64;
        let msg_header_offs = (idx as u64)
            .checked_mul(msg_header_size)
            .ok_or(Errno::EOVERFLOW)?;
        let offset = self
            .msgs_offset
            .checked_add(msg_header_offs)
            .ok_or(Errno::EOVERFLOW)?;
        self.request.write_mem_all(&msg_header, offset)?;

        // Copy peer address into sandbox process memory.
        if let Some((bytes, nam_ptr, nam_len, namelen_out)) = nam_write {
            #[expect(clippy::cast_possible_truncation)]
            let out_len = (namelen_out.min(nam_len as socklen_t)) as usize;
            self.request.write_mem_all(&bytes[..out_len], nam_ptr)?;
        }

        Ok(())
    }
}