]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
accept_filter: Fix filter parameter handling
authorMark Johnston <markj@FreeBSD.org>
Thu, 25 Mar 2021 21:55:20 +0000 (17:55 -0400)
committerMark Johnston <markj@FreeBSD.org>
Sun, 28 Mar 2021 00:25:19 +0000 (20:25 -0400)
commit6008a5fad3c110c4ec03cc3fe60ce41c4e548b98
tree5e5d313e6addf081271b46e9b42955c838890b21
parent5cc4e912e031c717e6ee6c2a0fd92137cc2dcefc
accept_filter: Fix filter parameter handling

For filters which implement accf_create, the setsockopt(2) handler
caches the filter name in the socket, but it also incorrectly frees the
buffer containing the copy, leaving a dangling pointer.  Note that no
accept filters provided in the base system are susceptible to this, as
they don't implement accf_create.

Reported by: Alexey Kulaev <alex.qart@gmail.com>
Discussed with: emaste
Security: kernel use-after-free
MFC after: 3 days
Sponsored by: The FreeBSD Foundation

(cherry picked from commit 653a437c04440495cd8e7712c7cf39444f26f1ee)
sys/kern/uipc_accf.c