Date: Fri, 25 Jan 2019 15:44:53 +0000 (UTC) From: Michael Tuexen <tuexen@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r343435 - stable/12/sys/netinet Message-ID: <201901251544.x0PFirlL052126@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: tuexen Date: Fri Jan 25 15:44:53 2019 New Revision: 343435 URL: https://svnweb.freebsd.org/changeset/base/343435 Log: MFC r342879: Fix getsockopt() for IP_OPTIONS/IP_RETOPTS. r336616 copies inp->inp_options using the m_dup() function. However, this function expects an mbuf packet header at the beginning, which is not true in this case. Therefore, use m_copym() instead of m_dup(). This issue was found by syzkaller. Reviewed by: mmacy@ Sponsored by: Netflix, Inc. Differential Revision: https://reviews.freebsd.org/D18753 Modified: stable/12/sys/netinet/ip_output.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/netinet/ip_output.c ============================================================================== --- stable/12/sys/netinet/ip_output.c Fri Jan 25 15:40:51 2019 (r343434) +++ stable/12/sys/netinet/ip_output.c Fri Jan 25 15:44:53 2019 (r343435) @@ -1262,7 +1262,8 @@ ip_ctloutput(struct socket *so, struct sockopt *sopt) if (inp->inp_options) { struct mbuf *options; - options = m_dup(inp->inp_options, M_NOWAIT); + options = m_copym(inp->inp_options, 0, + M_COPYALL, M_NOWAIT); INP_RUNLOCK(inp); if (options != NULL) { error = sooptcopyout(sopt,
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201901251544.x0PFirlL052126>