d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

unix/dgram: don't panic if socket buffer has negative space

Browse Source 
That's a legitimate scenario, although unlikely.

Reported by:	https://syzkaller.appspot.com/bug?extid=6e8be1ec8d77578a3df4
This commit is contained in:
Gleb Smirnoff 2022-08-19 12:13:34 -07:00
parent 97be6fced7
commit 820bafd0bc
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
sys/kern/uipc_usrreq.c
View File

@ -1096,8 +1096,13 @@ uipc_dgram_sbspace(struct sockbuf *sb, u_int cc, u_int mbcnt)
{
u_int bleft, mleft;
MPASS(sb->sb_hiwat >= sb->uxdg_cc);
MPASS(sb->sb_mbmax >= sb->uxdg_mbcnt);
/*
* Negative space may happen if send(2) is followed by
* setsockopt(SO_SNDBUF/SO_RCVBUF) that shrinks maximum.
*/
if (__predict_false(sb->sb_hiwat < sb->uxdg_cc ||
sb->sb_mbmax < sb->uxdg_mbcnt))
return (false);
if (__predict_false(sb->sb_state & SBS_CANTRCVMORE))
return (false);