[PATCH iproute2 0/2] ss: reject malformed /proc fallback records

[PATCH iproute2 0/2] ss: reject malformed /proc fallback records

[Prabhakar Pujeri]

The packet and netlink fallback parsers use sscanf() to read records from
/proc.  Both paths used the output variables without first checking that
all expected fields were present.

Require a complete record before filtering or printing it.  This prevents
malformed input from leaving socket fields uninitialized.

Tested with a full iproute2 build.

Prabhakar Pujeri (2):
  ss: validate sscanf() return value in packet_show_line()
  ss: validate sscanf() return value in netlink_show()

 misc/ss.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

-- 
2.55.0

[PATCH iproute2 1/2] ss: validate sscanf() return value in packet_show_line()

[Prabhakar Pujeri]

The /proc/net/packet fallback parser never checks the return value of
sscanf().  On a malformed or truncated line some of the output
variables (type, prot, iface, state, rq, uid, ino) stay
uninitialized and garbage values are used both for type based
filtering and for the printed socket state.

Require all eight fields to be converted before using the values and
return -1 on failure, which makes generic_record_read() stop
processing, the same way tcp_show_line() bails out on a malformed
/proc/net/tcp line.

Fixes: aba5acdfdb34 ("(Logical change 1.3)")
Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
---
 misc/ss.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c
index 26520cee..098eed27 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -4922,10 +4922,11 @@ static int packet_show_line(char *buf, const struct filter *f, int fam)
 	struct sockstat stat = {};
 	int type, prot, iface, state, rq, uid, ino;
 
-	sscanf(buf, "%llx %*d %d %x %d %d %u %u %u",
+	if (sscanf(buf, "%llx %*d %d %x %d %d %u %u %u",
 			&sk,
 			&type, &prot, &iface, &state,
-			&rq, &uid, &ino);
+			&rq, &uid, &ino) != 8)
+		return -1;
 
 	if (type == SOCK_RAW && !(f->dbs & (1<<PACKET_R_DB)))
 		return 0;
-- 
2.55.0

Re: [PATCH iproute2 1/2] ss: validate sscanf() return value in packet_show_line()

[Stephen Hemminger]

On Mon, 31 Aug 2026 10:41:15 +0000
Prabhakar Pujeri <prabhakar.pujeri@dell.com> wrote:

> The /proc/net/packet fallback parser never checks the return value of
> sscanf().  On a malformed or truncated line some of the output
> variables (type, prot, iface, state, rq, uid, ino) stay
> uninitialized and garbage values are used both for type based
> filtering and for the printed socket state.
> 
> Require all eight fields to be converted before using the values and
> return -1 on failure, which makes generic_record_read() stop
> processing, the same way tcp_show_line() bails out on a malformed
> /proc/net/tcp line.
> 
> Fixes: aba5acdfdb34 ("(Logical change 1.3)")
> Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
> ---

Good to check but if kernel gives garbage, kernel is seriously buggy.

I am thinking it would be best to just remove /proc fallback stuff.
It only exists to handle really old systems before netlink diag info
was supported; or embedded hardware kernel configs without netlink diag info.

[PATCH iproute2 2/2] ss: validate sscanf() return value in netlink_show()

[Prabhakar Pujeri]

The /proc/net/netlink fallback loop never checks the return value of
sscanf().  On a malformed or truncated line the output variables
(sk, prot, pid, groups, rq, wq, cb) stay uninitialized and garbage
values are passed on to netlink_show_one() and printed as socket
state.

Require all eight fields to be converted before using the values and
stop the read loop on failure, consistent with the other /proc
parsers in ss.c.

Fixes: aba5acdfdb34 ("(Logical change 1.3)")
Signed-off-by: Prabhakar Pujeri <prabhakar.pujeri@dell.com>
---
 misc/ss.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/misc/ss.c b/misc/ss.c
index 098eed27..7d9c5e91 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -5299,9 +5299,10 @@ static int netlink_show(struct filter *f)
 	}
 
 	while (fgets(buf, sizeof(buf), fp)) {
-		sscanf(buf, "%llx %d %d %x %d %d %llx %d",
-		       &sk,
-		       &prot, &pid, &groups, &rq, &wq, &cb, &rc);
+		if (sscanf(buf, "%llx %d %d %x %d %d %llx %d",
+			   &sk,
+			   &prot, &pid, &groups, &rq, &wq, &cb, &rc) != 8)
+			break;
 
 		netlink_show_one(f, prot, pid, groups, 0, 0, 0, rq, wq, sk, cb);
 	}
-- 
2.55.0