diff options
| author |   sashan <sashan@openbsd.org> | 2020-03-11 22:21:28 +0000 |
|---|---|---|
| committer | sashan <sashan@openbsd.org> | 2020-03-11 22:21:28 +0000 |
| commit | aa1987fe7ce43547b96c53f0bcd1bcbc69d88e5a (patch) | |
| tree | 2b68914aff74805e88a84a9f693bbfeac47e55ac | |
| parent | Anthony Steinhauser reports that 32-bit arm cpus have the same speculation (diff) | |
| download | wireguard-openbsd-aa1987fe7ce43547b96c53f0bcd1bcbc69d88e5a.tar.xz wireguard-openbsd-aa1987fe7ce43547b96c53f0bcd1bcbc69d88e5a.zip | |
Fix unlimited recursion caused by local outbound bcast/mcast packet
sent via spliced socket.
Reported-by: syzbot+2f9616f39d3f3b281cfb@syzkaller.appspotmail.com
OK bluhm@
| -rw-r--r-- | sys/kern/uipc_socket.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 0caeaae743e..1669cbf9121 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uipc_socket.c,v 1.241 2020/02/20 16:56:52 visa Exp $ */ +/* $OpenBSD: uipc_socket.c,v 1.242 2020/03/11 22:21:28 sashan Exp $ */ /* $NetBSD: uipc_socket.c,v 1.21 1996/02/04 02:17:52 christos Exp $ */ /* @@ -1430,9 +1430,15 @@ somove(struct socket *so, int wait) /* * By splicing sockets connected to localhost, userland might create a * loop. Dissolve splicing with error if loop is detected by counter. + * + * If we deal with looped broadcast/multicast packet we bail out with + * no error to suppress splice termination. */ - if ((m->m_flags & M_PKTHDR) && m->m_pkthdr.ph_loopcnt++ >= M_MAXLOOP) { - error = ELOOP; + if ((m->m_flags & M_PKTHDR) && + ((m->m_pkthdr.ph_loopcnt++ >= M_MAXLOOP) || + ((m->m_flags & M_LOOP) && (m->m_flags & (M_BCAST|M_MCAST))))) { + if (m->m_pkthdr.ph_loopcnt >= M_MAXLOOP) + error = ELOOP; goto release; } |