Page MenuHomeFreeBSD

Check IPv4 options when using IP_HDRINCL socket option on SOCK_RAW sockets
ClosedPublic

Authored by tuexen on Jan 13 2019, 3:34 PM.

Details

Summary

When sending a packet on a socket(AF_INET, SOCKRAW, ...) socket having the IP_HDRINCL socket option enabled, the user can provide inconsistent data for the options in the IPv4 header. When the packets need to be fragmented, the function ip_optcopy assumes the the IP options have a valid layout. The valid layouts are described in RFC 791. This patch verifies that the user provides the IP options using a valid layout.

This issue was found by running syzkaller on OpenBSD. Greg Steuck made me aware that the problem might also exist on FreeBSD.

Test Plan

Use the attached test program on a kernel with INVARIANTS enabled. Without the fix, the kernel panics. With the fix, the write() call fails.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

tuexen created this revision.Jan 13 2019, 3:34 PM
tuexen updated this revision to Diff 53183.Fri, Jan 25, 9:04 AM

Use explicit page number range instead of 15ff as suggested by lstewart@.

This revision was not accepted when it landed; it landed in state Needs Review.Tue, Feb 12, 10:17 AM
This revision was automatically updated to reflect the committed changes.