d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Improve the input validation for l_linger.

Browse Source 
When using the SOL_SOCKET level socket option SO_LINGER, the structure
struct linger is used as the option value. The component l_linger is of
type int, but internally copied to the field so_linger of the structure
struct socket. The type of so_linger is short, but it is assumed to be
non-negative and the value is used to compute ticks to be stored in a
variable of type int.

Therefore, perform input validation on l_linger similar to the one
performed by NetBSD and OpenBSD.

Thanks to syzkaller for making me aware of this issue.

Thanks to markj@ for pointing out that a similar check should be added
to so_linger_set().

Reviewed by:		markj@
MFC after:		2 weeks
Differential Revision:	https://reviews.freebsd.org/D20948
This commit is contained in:
Michael Tuexen 2019-07-14 21:44:18 +00:00
parent b7b6b7a9c5
commit a85b7f125b
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/kern/uipc_socket.c
View File

@ -2776,7 +2776,12 @@ sosetopt(struct socket *so, struct sockopt *sopt)
error = sooptcopyin(sopt, &l, sizeof l, sizeof l);
if (error)
goto bad;
if (l.l_linger < 0 ||
l.l_linger > USHRT_MAX ||
l.l_linger > (INT_MAX / hz)) {
error = EDOM;
goto bad;
}
SOCK_LOCK(so);
so->so_linger = l.l_linger;
if (l.l_onoff)
@ -4106,6 +4111,9 @@ void
so_linger_set(struct socket *so, int val)
{
KASSERT(val >= 0 && val <= USHRT_MAX && val <= (INT_MAX / hz),
("%s: val %d out of range", __func__, val));
so->so_linger = val;
}