Page MenuHomeFreeBSD

Input validation for l_linger
ClosedPublic

Authored by tuexen on Jul 14 2019, 2:44 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sun, Oct 12, 12:51 AM
Unknown Object (File)
Sat, Oct 4, 3:39 PM
Unknown Object (File)
Fri, Oct 3, 1:47 AM
Unknown Object (File)
Thu, Sep 25, 2:00 AM
Unknown Object (File)
Sep 12 2025, 4:02 AM
Unknown Object (File)
Sep 4 2025, 3:40 PM
Unknown Object (File)
Aug 15 2025, 5:53 AM
Unknown Object (File)
Aug 14 2025, 8:05 AM
Subscribers

Details

Summary

When using the SOL_SOCKET level socket option SO_LINGER, the structure struct linger is used as the option value. The component l_linger is of type int, but internally copied to the field so_linger of the structure struct socket. The type of so_linger is short, but it is assumed to be non-negative and the value is used to compute ticks to be stored in a variable of type int.

Therefore, perform input validation on l_linger similar to the one performed by NetBSD and OpenBSD.

Thanks to syzkaller for making me aware of this issue.

Diff Detail

Repository
rS FreeBSD src repository - subversion
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

We also have the (unused) so_linger_set(), which should possibly assert that the input value is valid.

This revision is now accepted and ready to land.Jul 14 2019, 5:07 PM

Use KASSERT in so_linger_set() to ensure that the value is valid as suggested by markj@.

This revision now requires review to proceed.Jul 14 2019, 7:02 PM

We also have the (unused) so_linger_set(), which should possibly assert that the input value is valid.

Added in updated version.

This revision is now accepted and ready to land.Jul 14 2019, 7:35 PM
This revision was automatically updated to reflect the committed changes.