Mark Johnston 653a437c04 accept_filter: Fix filter parameter handling
For filters which implement accf_create, the setsockopt(2) handler
caches the filter name in the socket, but it also incorrectly frees the
buffer containing the copy, leaving a dangling pointer.  Note that no
accept filters provided in the base system are susceptible to this, as
they don't implement accf_create.

Reported by:	Alexey Kulaev <alex.qart@gmail.com>
Discussed with:	emaste
Security:	kernel use-after-free
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation
2021-03-25 17:55:46 -04:00
..
2020-02-26 16:22:28 +00:00
2021-01-02 19:57:58 -07:00
2020-10-05 15:54:19 +00:00
2021-02-23 17:47:07 +00:00
2020-11-19 02:50:48 +00:00
2020-12-04 18:56:44 +00:00
2020-11-05 15:08:56 +00:00
2018-10-12 00:32:45 +00:00
2020-11-09 00:34:23 +00:00
2020-08-13 20:48:14 +00:00
2019-02-20 09:38:19 +00:00
2020-12-01 16:06:31 +00:00
2020-01-12 23:52:16 +00:00
2020-08-27 05:11:15 +00:00
2021-03-18 20:52:20 +00:00
2021-02-25 10:04:44 -05:00
2021-02-21 00:43:05 +00:00
2021-02-21 00:43:05 +00:00