Page MenuHomeFreeBSD

Input validation for l_linger
ClosedPublic

Authored by tuexen on Jul 14 2019, 2:44 PM.
Tags
None
Referenced Files
F132419754: D20948.id.diff
Thu, Oct 16, 7:01 PM
F132419753: D20948.id59736.diff
Thu, Oct 16, 7:01 PM
F132419752: D20948.id59744.diff
Thu, Oct 16, 7:01 PM
F132419751: D20948.id59743.diff
Thu, Oct 16, 7:01 PM
F132375940: D20948.diff
Thu, Oct 16, 8:50 AM
Unknown Object (File)
Sun, Oct 12, 12:51 AM
Unknown Object (File)
Sat, Oct 4, 3:39 PM
Unknown Object (File)
Fri, Oct 3, 1:47 AM
Subscribers

Details

Summary

When using the SOL_SOCKET level socket option SO_LINGER, the structure struct linger is used as the option value. The component l_linger is of type int, but internally copied to the field so_linger of the structure struct socket. The type of so_linger is short, but it is assumed to be non-negative and the value is used to compute ticks to be stored in a variable of type int.

Therefore, perform input validation on l_linger similar to the one performed by NetBSD and OpenBSD.

Thanks to syzkaller for making me aware of this issue.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

We also have the (unused) so_linger_set(), which should possibly assert that the input value is valid.

This revision is now accepted and ready to land.Jul 14 2019, 5:07 PM

Use KASSERT in so_linger_set() to ensure that the value is valid as suggested by markj@.

This revision now requires review to proceed.Jul 14 2019, 7:02 PM

We also have the (unused) so_linger_set(), which should possibly assert that the input value is valid.

Added in updated version.

This revision is now accepted and ready to land.Jul 14 2019, 7:35 PM
This revision was automatically updated to reflect the committed changes.