[Swatantra-66]

Summary

Fails sendmsg() in net/usrsock with -EINVAL when the sum of iov_len values exceeds MIN(SSIZE_MAX, UINT32_MAX).

Previously, usrsock_sendmsg() accumulated iov_len values directly into req.buflen (uint32_t) without overflow detection. If the sum wrapped around, the subsequent check:

if (req.buflen > UINT32_MAX)
  {
    req.buflen = UINT32_MAX;
  }

was dead code because req.buflen is typed uint32_t and can never exceed UINT32_MAX. This allowed silent integer wrap-around and protocol desync when queuing large scatter/gather vectors.

The check enforces (size_t)MIN(SSIZE_MAX, UINT32_MAX) - req.buflen:

• On 32-bit platforms, it enforces the POSIX IEEE Std 1003.1 limit (SSIZE_MAX = 2 GB), matching net/inet (commit 3671f94) and fs/vfs/fs_uio.c.
• On 64-bit platforms, SSIZE_MAX is 8 Exabytes, so the bound clamps to UINT32_MAX (4 GB) to prevent req.buflen (uint32_t) from silently wrapping around.

Impact

• Impact on user: POSIX IEEE Std 1003.1 compliance for sendmsg() over usrsock. Prevents silent integer wrap-around and protocol corruption when the sum of iov_len values exceeds SSIZE_MAX or UINT32_MAX.
• Impact on build: None.
• Impact on hardware: None.

Testing

• CI Linters: Verified locally against full CI checkpatch: ./tools/checkpatch.sh -c -u -m -g upstream/master..HEAD (exit code 0, all checks passed including codespell, cvt2utf, commit message validator, and nxstyle).
• nxstyle: Verified net/usrsock/usrsock_sendmsg.c has 0 errors and 0 warnings with nxstyle.
• Sign-compare: Verified clean compilation under GCC with -Werror=sign-compare on both 32-bit and 64-bit targets.

[github-actions]

MemBrowse Memory Report · Explore what changed →

No memory changes detected for:

• arduino-mega2560
• esp32-devkitc
• hifive1-revb
• mirtoo
• qemu-armv8a
• qemu-intel64
• rx65n-rsk2mb
• s698pm-dkit
• stm32-nucleo-f103rb

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}