HomeFreeBSD

accept_filter: Fix filter parameter handling

Description

accept_filter: Fix filter parameter handling

For filters which implement accf_create, the setsockopt(2) handler
caches the filter name in the socket, but it also incorrectly frees the
buffer containing the copy, leaving a dangling pointer. Note that no
accept filters provided in the base system are susceptible to this, as
they don't implement accf_create.

Reported by: Alexey Kulaev <alex.qart@gmail.com>
Discussed with: emaste
Security: kernel use-after-free
MFC after: 3 days
Sponsored by: The FreeBSD Foundation

Details

Provenance
markjAuthored on Mar 25 2021, 9:55 PM
Parents
rG15f335556783: cxgbe(4): Allow a T6 adapter to switch between TOE and NIC TLS mode.
Branches
Unknown
Tags
Unknown