Page MenuHomeFreeBSD

so_splice: Synchronize so_unsplice() with so_splice()
ClosedPublic

Authored by markj on Apr 13 2025, 3:45 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Oct 15, 1:34 PM
Unknown Object (File)
Thu, Oct 9, 9:02 PM
Unknown Object (File)
Thu, Oct 2, 5:50 PM
Unknown Object (File)
Wed, Oct 1, 6:42 PM
Unknown Object (File)
Tue, Sep 30, 7:04 PM
Unknown Object (File)
Thu, Sep 25, 3:23 PM
Unknown Object (File)
Wed, Sep 24, 3:35 AM
Unknown Object (File)
Sun, Sep 21, 5:37 PM
Subscribers

Details

Summary

so_unsplice() assumed that if SB_SPLICED is set in the receive buffer of
the first socket, then the splice is fully initialized. However, that's
not true, and it's possible for so_unsplice() to race ahead of
so_splice().

Modify so_unsplice() to simply bail if the splice state is embryonic.

Reported by: syzkaller

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable