Page MenuHomeFreeBSD

Input validation for l_linger
ClosedPublic

Authored by tuexen on Jul 14 2019, 2:44 PM.

Details

Summary

When using the SOL_SOCKET level socket option SO_LINGER, the structure struct linger is used as the option value. The component l_linger is of type int, but internally copied to the field so_linger of the structure struct socket. The type of so_linger is short, but it is assumed to be non-negative and the value is used to compute ticks to be stored in a variable of type int.

Therefore, perform input validation on l_linger similar to the one performed by NetBSD and OpenBSD.

Thanks to syzkaller for making me aware of this issue.

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

tuexen created this revision.Jul 14 2019, 2:44 PM
markj accepted this revision.Jul 14 2019, 5:07 PM

We also have the (unused) so_linger_set(), which should possibly assert that the input value is valid.

This revision is now accepted and ready to land.Jul 14 2019, 5:07 PM
tuexen updated this revision to Diff 59743.Jul 14 2019, 7:02 PM

Use KASSERT in so_linger_set() to ensure that the value is valid as suggested by markj@.

This revision now requires review to proceed.Jul 14 2019, 7:02 PM

We also have the (unused) so_linger_set(), which should possibly assert that the input value is valid.

Added in updated version.

markj accepted this revision.Jul 14 2019, 7:35 PM
This revision is now accepted and ready to land.Jul 14 2019, 7:35 PM
This revision was automatically updated to reflect the committed changes.