Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 25 Jan 2019 15:44:53 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org
Subject:   svn commit: r343435 - stable/12/sys/netinet
Message-ID:  <201901251544.x0PFirlL052126@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: tuexen
Date: Fri Jan 25 15:44:53 2019
New Revision: 343435
URL: https://svnweb.freebsd.org/changeset/base/343435

Log:
  MFC r342879:
  
  Fix getsockopt() for IP_OPTIONS/IP_RETOPTS.
  
  r336616 copies inp->inp_options using the m_dup() function.
  However, this function expects an mbuf packet header at the beginning,
  which is not true in this case.
  Therefore, use m_copym() instead of m_dup().
  
  This issue was found by syzkaller.
  
  Reviewed by:		mmacy@
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D18753

Modified:
  stable/12/sys/netinet/ip_output.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/ip_output.c
==============================================================================
--- stable/12/sys/netinet/ip_output.c	Fri Jan 25 15:40:51 2019	(r343434)
+++ stable/12/sys/netinet/ip_output.c	Fri Jan 25 15:44:53 2019	(r343435)
@@ -1262,7 +1262,8 @@ ip_ctloutput(struct socket *so, struct sockopt *sopt)
 			if (inp->inp_options) {
 				struct mbuf *options;
 
-				options = m_dup(inp->inp_options, M_NOWAIT);
+				options = m_copym(inp->inp_options, 0,
+				    M_COPYALL, M_NOWAIT);
 				INP_RUNLOCK(inp);
 				if (options != NULL) {
 					error = sooptcopyout(sopt,



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201901251544.x0PFirlL052126>