Fix getsockopt(..., IPPROTO_IP, IP_OPTIONS, ..., ...)
ClosedPublic
Actions

Authored by tuexen on Jan 5 2019, 12:44 PM.

Tags

None

Referenced Files

	F137719644: D18753.id52577.diff
	Tue, Nov 25, 5:20 AM

	Unknown Object (File)
	Mon, Nov 24, 4:15 PM

	Unknown Object (File)
	Mon, Nov 24, 1:17 AM

	Unknown Object (File)
	Sun, Nov 23, 1:41 PM

	Unknown Object (File)
	Sun, Nov 23, 3:24 AM

	Unknown Object (File)
	Thu, Nov 20, 8:53 PM

	Unknown Object (File)
	Thu, Nov 20, 8:51 PM

	Unknown Object (File)
	Thu, Nov 20, 8:51 PM

View All Files

Subscribers

imp

Details

Reviewers

mmacy
jason_eggnet.com
sbruno
jhb

Commits

rS343435: MFC r342879:
rS342879: Fix getsockopt() for IP_OPTIONS/IP_RETOPTS.

Summary

r336616 copies inp->inp_options using the m_dup() function. However, this function expects an mbuf packet header at the beginning, which is not true in this case. Therefore, use m_copym() instead of m_dup().

Test Plan

Use the attached test program to verify that getsockopt(..., IPPROTO_IP, IP_OPTIONS, ..., ...) works. Without the patch, the system panics when running the test program.

This issue what found by running syzkaller.

ip_options.c526 BDownload