d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a potential use after free in getsockopt() access to inp_options

Browse Source 
Discussed with: jhb
Reviewed by:	sbruno, transport
MFC after:	2 weeks
Sponsored by:	Limelight Networks
Differential Revision:	https://reviews.freebsd.org/D14621
This commit is contained in:
Matt Macy 2018-07-22 20:02:14 +00:00
parent 84f0fb8a93
commit e5e3e746fe
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
sys/netinet/ip_output.c
View File

@ -1256,13 +1256,23 @@ ip_ctloutput(struct socket *so, struct sockopt *sopt)
switch (sopt->sopt_name) {
case IP_OPTIONS:
case IP_RETOPTS:
if (inp->inp_options)
error = sooptcopyout(sopt,
mtod(inp->inp_options,
char *),
inp->inp_options->m_len);
else
INP_RLOCK(inp);
if (inp->inp_options) {
struct mbuf *options;
options = m_dup(inp->inp_options, M_NOWAIT);
INP_RUNLOCK(inp);
if (options != NULL) {
error = sooptcopyout(sopt,
mtod(options, char *),
options->m_len);
m_freem(options);
} else
error = ENOMEM;
} else {
INP_RUNLOCK(inp);
sopt->sopt_valsize = 0;
}
break;
case IP_TOS: