From 70509d14439bbf55b8232d4cfcb2acafe094a334 Mon Sep 17 00:00:00 2001 From: gordon Date: Wed, 8 Jul 2020 20:11:40 +0000 Subject: [PATCH] Fix IPv6 socket option race condition and use after free. Approved by: so Security: FreeBSD-SA-20:20.ipv6 Security: CVE-2020-7457 --- sys/netinet6/ip6_output.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c index 2fde1e3186d..4592e3598b6 100644 --- a/sys/netinet6/ip6_output.c +++ b/sys/netinet6/ip6_output.c @@ -1498,8 +1498,10 @@ ip6_ctloutput(struct socket *so, struct sockopt *sopt) error = soopt_mcopyin(sopt, m); /* XXX */ if (error != 0) break; + INP_WLOCK(in6p); error = ip6_pcbopts(&in6p->in6p_outputopts, m, so, sopt); + INP_WUNLOCK(in6p); m_freem(m); /* XXX */ break; } @@ -2244,8 +2246,11 @@ ip6_pcbopts(struct ip6_pktopts **pktopt, struct mbuf *m, printf("ip6_pcbopts: all specified options are cleared.\n"); #endif ip6_clearpktopts(opt, -1); - } else - opt = malloc(sizeof(*opt), M_IP6OPT, M_WAITOK); + } else { + opt = malloc(sizeof(*opt), M_IP6OPT, M_NOWAIT); + if (opt == NULL) + return (ENOMEM); + } *pktopt = NULL; if (!m || m->m_len == 0) { -- 2.45.0