svn commit: r342879 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Wed Jan  9 06:36:57 2019
New Revision: 342879
URL: https://svnweb.freebsd.org/changeset/base/342879

Log:
  Fix getsockopt() for IP_OPTIONS/IP_RETOPTS.
  
  r336616 copies inp->inp_options using the m_dup() function.
  However, this function expects an mbuf packet header at the beginning,
  which is not true in this case.
  Therefore, use m_copym() instead of m_dup().
  
  This issue was found by syzkaller.
  Reviewed by:		mmacy@
  MFC after:		1 week
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D18753

Modified:
  head/sys/netinet/ip_output.c

Modified: head/sys/netinet/ip_output.c
==============================================================================
--- head/sys/netinet/ip_output.c	Wed Jan  9 06:21:49 2019	(r342878)
+++ head/sys/netinet/ip_output.c	Wed Jan  9 06:36:57 2019	(r342879)
@@ -1263,7 +1263,8 @@ ip_ctloutput(struct socket *so, struct sockopt *sopt)
 			if (inp->inp_options) {
 				struct mbuf *options;
 
-				options = m_dup(inp->inp_options, M_NOWAIT);
+				options = m_copym(inp->inp_options, 0,
+				    M_COPYALL, M_NOWAIT);
 				INP_RUNLOCK(inp);
 				if (options != NULL) {
 					error = sooptcopyout(sopt,