Date: Wed, 22 Oct 2025 15:48:25 GMT From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: ef159100ec2b - stable/15 - inpcb: Ignore SO_REUSEPORT_LB on connected sockets Message-ID: <202510221548.59MFmPtk022166@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=ef159100ec2b73c22caccc00555bae4c3cbc0ea1 commit ef159100ec2b73c22caccc00555bae4c3cbc0ea1 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2025-10-06 13:37:47 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2025-10-22 15:48:01 +0000 inpcb: Ignore SO_REUSEPORT_LB on connected sockets While TCP disallows connect()ing a socket with SO_REUSEPORT_LB, UDP does not. As a result, a connected UDP socket can be placed in the lbgroup hash and thus receive datagrams from sources other than the connected host. Reported by: Amit Klein <amit.klein@mail.huji.ac.il> Reported by: Omer Ben Simhon <omer.bensimhon@mail.huji.ac.il> Reviewed by: glebius Approved by: so Security: FreeBSD-SA-25:09.netinet Security: CVE-2025-24934 (cherry picked from commit 320ad3dec5ff1b37f6907a47961c18b9d77e6a53) --- sys/netinet/in_pcb.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c index dbe48242381d..712ff28768dc 100644 --- a/sys/netinet/in_pcb.c +++ b/sys/netinet/in_pcb.c @@ -2665,10 +2665,13 @@ in_pcbinshash(struct inpcb *inp) INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_porthashmask)]; /* - * Add entry to load balance group. - * Only do this if SO_REUSEPORT_LB is set. + * Ignore SO_REUSEPORT_LB if the socket is connected. Really this case + * should be an error, but for UDP sockets it is not, and some + * applications erroneously set it on connected UDP sockets, so we can't + * change this without breaking compatibility. */ - if ((inp->inp_socket->so_options & SO_REUSEPORT_LB) != 0) { + if (!connected && + (inp->inp_socket->so_options & SO_REUSEPORT_LB) != 0) { int error = in_pcbinslbgrouphash(inp, M_NODOM); if (error != 0) return (error); @@ -2770,6 +2773,10 @@ in_pcbrehash(struct inpcb *inp) connected = !in_nullhost(inp->inp_faddr); } + /* See the comment in in_pcbinshash(). */ + if (connected && (inp->inp_flags & INP_INLBGROUP) != 0) + in_pcbremlbgrouphash(inp); + /* * When rehashing, the caller must ensure that either the new or the old * foreign address was unspecified.help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202510221548.59MFmPtk022166>