git: 320ad3dec5ff - main - inpcb: Ignore SO_REUSEPORT_LB on connected sockets

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=320ad3dec5ff1b37f6907a47961c18b9d77e6a53

commit 320ad3dec5ff1b37f6907a47961c18b9d77e6a53
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2025-10-06 13:37:47 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2025-10-22 15:42:49 +0000

    inpcb: Ignore SO_REUSEPORT_LB on connected sockets
    
    While TCP disallows connect()ing a socket with SO_REUSEPORT_LB, UDP does
    not.  As a result, a connected UDP socket can be placed in the lbgroup
    hash and thus receive datagrams from sources other than the connected
    host.
    
    Reported by:    Amit Klein <amit.klein@mail.huji.ac.il>
    Reported by:    Omer Ben Simhon <omer.bensimhon@mail.huji.ac.il>
    Reviewed by:    glebius
    Approved by:    so
    Security:       FreeBSD-SA-25:09.netinet
    Security:       CVE-2025-24934
---
 sys/netinet/in_pcb.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index dbe48242381d..712ff28768dc 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -2665,10 +2665,13 @@ in_pcbinshash(struct inpcb *inp)
 	    INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_porthashmask)];
 
 	/*
-	 * Add entry to load balance group.
-	 * Only do this if SO_REUSEPORT_LB is set.
+	 * Ignore SO_REUSEPORT_LB if the socket is connected.  Really this case
+	 * should be an error, but for UDP sockets it is not, and some
+	 * applications erroneously set it on connected UDP sockets, so we can't
+	 * change this without breaking compatibility.
 	 */
-	if ((inp->inp_socket->so_options & SO_REUSEPORT_LB) != 0) {
+	if (!connected &&
+	    (inp->inp_socket->so_options & SO_REUSEPORT_LB) != 0) {
 		int error = in_pcbinslbgrouphash(inp, M_NODOM);
 		if (error != 0)
 			return (error);
@@ -2770,6 +2773,10 @@ in_pcbrehash(struct inpcb *inp)
 		connected = !in_nullhost(inp->inp_faddr);
 	}
 
+	/* See the comment in in_pcbinshash(). */
+	if (connected && (inp->inp_flags & INP_INLBGROUP) != 0)
+		in_pcbremlbgrouphash(inp);
+
 	/*
 	 * When rehashing, the caller must ensure that either the new or the old
 	 * foreign address was unspecified.