Page MenuHomeFreeBSD

Fix synchronization in the IPV6_2292PKTOPTIONS set handler.
ClosedPublic

Authored by markj on Thu, Mar 19, 5:58 PM.

Details

Summary

The inpcb needs to be locked when we update output packet options.
Otherwise it is possible for the IPV6_2292PKTOPTIONS handler to free
packet option structures while another thread is reading or updating
them.

Note that the option handler is still kind of broken. For instance it
frees all options before performing privilege checks for individual
options. However, this can be fixed separately.

Reported by: syzbot+52eb0fd4ddc119787f9d@syzkaller.appspotmail.com

Diff Detail

Repository
rS FreeBSD src repository
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

markj created this revision.Thu, Mar 19, 5:58 PM
tuexen accepted this revision.Thu, Mar 19, 7:19 PM
This revision is now accepted and ready to land.Thu, Mar 19, 7:19 PM
bz accepted this revision.Thu, Mar 19, 8:54 PM
This revision was automatically updated to reflect the committed changes.