From 83fc5aca02579f5c3bc00a67258c67d37fee1ef2 Mon Sep 17 00:00:00 2001 From: Ahmed Elaidy Date: Wed, 25 Feb 2026 21:09:00 +0200 Subject: [PATCH] sk-queue: Add missing MSG_CTRUNC check in dump_sk_queue After recvmsg() with MSG_PEEK, dump_sk_queue() checks for MSG_TRUNC (data truncation) but not MSG_CTRUNC (control data truncation). When the control message buffer is too small, the kernel sets MSG_CTRUNC and silently discards the overflowing ancillary data. For SCM_RIGHTS, this means passed file descriptors are lost without any error. Add a MSG_CTRUNC check right after the existing MSG_TRUNC check so that dump fails explicitly instead of silently producing an incomplete image. Signed-off-by: Ahmed Elaidy --- criu/sk-queue.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/criu/sk-queue.c b/criu/sk-queue.c index dbd9d1d8b..c59ac36ba 100644 --- a/criu/sk-queue.c +++ b/criu/sk-queue.c @@ -244,6 +244,17 @@ int dump_sk_queue(int sock_fd, int sock_id) ret = -E2BIG; goto err_set_sock; } + if (msg.msg_flags & MSG_CTRUNC) { + /* + * Control data truncated. This means the cmsg + * buffer was too small and SCM data (such as + * passed file descriptors) has been silently + * discarded by the kernel. + */ + pr_err("sys_recvmsg failed: control data truncated\n"); + ret = -E2BIG; + goto err_set_sock; + } if (dump_packet_cmsg(&msg, &pe)) goto err_set_sock;