git: 590b45036ee1 - main - socket: Handle the possibility of a protocol with no ctloutput
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Mon, 31 Mar 2025 09:06:34 UTC
The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=590b45036ee16163f9eb8c34791d197e76de502d commit 590b45036ee16163f9eb8c34791d197e76de502d Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2025-03-29 08:55:08 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2025-03-31 09:01:09 +0000 socket: Handle the possibility of a protocol with no ctloutput Add a default ctloutput handler and remove various NULL checks. This fixes a problem wherein the generic SO_SETFIB handler did not check whether the protocol has a ctloutput implementation before calling the function pointer. Reported by: syzkaller Reviewed by: glebius Fixes: caccbaef8e26 ("socket: Move SO_SETFIB handling to protocol layers") MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D49436 --- sys/kern/uipc_domain.c | 7 +++++++ sys/kern/uipc_socket.c | 12 +++--------- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/sys/kern/uipc_domain.c b/sys/kern/uipc_domain.c index 51e0f8cc7726..2d68e11b9f0a 100644 --- a/sys/kern/uipc_domain.c +++ b/sys/kern/uipc_domain.c @@ -97,6 +97,12 @@ pr_control_notsupp(struct socket *so, u_long cmd, void *data, return (EOPNOTSUPP); } +static int +pr_ctloutput_notsupp(struct socket *so, struct sockopt *sopt) +{ + return (ENOPROTOOPT); +} + static int pr_disconnect_notsupp(struct socket *so) { @@ -194,6 +200,7 @@ pr_init(struct domain *dom, struct protosw *pr) NOTSUPP(pr_connect2); NOTSUPP(pr_connectat); NOTSUPP(pr_control); + NOTSUPP(pr_ctloutput); NOTSUPP(pr_disconnect); NOTSUPP(pr_listen); NOTSUPP(pr_peeraddr); diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c index 63d30f04c8e0..ac00696236a5 100644 --- a/sys/kern/uipc_socket.c +++ b/sys/kern/uipc_socket.c @@ -3804,10 +3804,7 @@ sosetopt(struct socket *so, struct sockopt *sopt) CURVNET_SET(so->so_vnet); error = 0; if (sopt->sopt_level != SOL_SOCKET) { - if (so->so_proto->pr_ctloutput != NULL) - error = (*so->so_proto->pr_ctloutput)(so, sopt); - else - error = ENOPROTOOPT; + error = (*so->so_proto->pr_ctloutput)(so, sopt); } else { switch (sopt->sopt_name) { case SO_ACCEPTFILTER: @@ -4017,7 +4014,7 @@ sosetopt(struct socket *so, struct sockopt *sopt) error = ENOPROTOOPT; break; } - if (error == 0 && so->so_proto->pr_ctloutput != NULL) + if (error == 0) (void)(*so->so_proto->pr_ctloutput)(so, sopt); } bad: @@ -4068,10 +4065,7 @@ sogetopt(struct socket *so, struct sockopt *sopt) CURVNET_SET(so->so_vnet); error = 0; if (sopt->sopt_level != SOL_SOCKET) { - if (so->so_proto->pr_ctloutput != NULL) - error = (*so->so_proto->pr_ctloutput)(so, sopt); - else - error = ENOPROTOOPT; + error = (*so->so_proto->pr_ctloutput)(so, sopt); CURVNET_RESTORE(); return (error); } else {