Change Details

When handling a TCP/IPv4 SYN-segment with an acceptable fast open cookie and source routing IP options, don't free the source routing IPv4 options while the inp still points to them. This avoids in a use after free scenario which can be observed by using a KASAN kernel. `ipopts` should only be freed, if the on-stack `struct syncache` is used and the pointer in this structure still points to the allocated `ipopts`. If these `ipopts` are moved from the `struct syncache` to the `struct inpcb` in `syncache_socket()`, which is called by `syncache_tfo_expand()`, the pointer in the `struct syncache` is set to `NULL`. In a FreeBSD default setup this problem is mitigated by # TCP fast open support on the server side not being enabled (the `sysctl`-variable `net.inet.tcp.fastopen.server_enable` is 0). # Incoming IP packet with source routing options are not being processed by the host stack (the `sysctl`-variable `net.inet.ip.accept_sourceroute` is 0). Only if these two `sysctl`-variables are changed, a FreeBSD system is affected, if a server actually using TCP fast open is running. This patch will be MFCed to stable/14 and stable/15. The issue was reported by Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai.

When handling a TCP/IPv4 SYN-segment with an acceptable fast open cookie and source routing IP options, don't free the source routing IPv4 options while the inp still points to them. This avoids in a use after free scenario which can be observed by using a KASAN kernel. `ipopts` should only be freed, if the on-stack `struct syncache` is used and the pointer in this structure still points to the allocated `ipopts`. If these `ipopts` are moved from the `struct syncache` to the `struct inpcb` in `syncache_socket()`, which is called by `syncache_tfo_expand()`, the pointer in the `struct syncache` is set to `NULL`. In a FreeBSD default setup this problem is mitigated by # TCP fast open support on the server side not being enabled (the `sysctl`-variable `net.inet.tcp.fastopen.server_enable` is 0). # Incoming IP packet with source routing options are not being processed by the host stack (the `sysctl`-variable `net.inet.ip.accept_sourceroute` is 0). Only if these two `sysctl`-variables are changed, a FreeBSD system is affected, if a server actually using TCP fast open is running. This patch will be MFCed to stable/14 and stable/15. The issue was reported by Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai.

When handling a TCP/IPv4 SYN-segment with an acceptable fast open cookie and source routing IP options, don't free the source routing IPv4 options while the inp still points to them. This avoids in a use after free scenario which can be observed by using a KASAN kernel. `ipopts` should only be freed, if the on-stack `struct syncache` is used and the pointer in this structure still points to the allocated `ipopts`. If these `ipopts` are moved from the `struct syncache` to the `struct inpcb` in `syncache_socket()`, which is called by `syncache_tfo_expand()`, the pointer in the `struct syncache` is set to `NULL`. In a FreeBSD default setup this problem is mitigated by # TCP fast open support on the server side not being enabled (the `sysctl`-variable `net.inet.tcp.fastopen.server_enable` is 0). # Incoming IP packet with source routing options are not being processed by the host stack (the `sysctl`-variable `net.inet.ip.accept_sourceroute` is 0). Only if these two `sysctl`-variables are changed, a FreeBSD system is affected, if a server actually using TCP fast open is running. This patch will be MFCed to stable/14 and stable/15. The issue was reported by Yuxiang Yang, Yizhou Zhao, Xuewei Feng, Qi Li, and Ke Xu from Tsinghua University using GLM5.1 from Z.ai.