svn commit: r336282 - head/sys/netinet

[Sean Bruno]

Author: sbruno
Date: Sat Jul 14 16:19:46 2018
New Revision: 336282
URL: https://svnweb.freebsd.org/changeset/base/336282

Log:
  Fixup memory management for fetching options in ip_ctloutput()
  
  Submitted by:	Jason Eggleston <jason at eggnet.com>
  Sponsored by:	Limelight Networks
  Differential Revision:	https://reviews.freebsd.org/D14621

Modified:
  head/sys/netinet/ip_output.c

Modified: head/sys/netinet/ip_output.c
==============================================================================
--- head/sys/netinet/ip_output.c	Sat Jul 14 16:06:53 2018	(r336281)
+++ head/sys/netinet/ip_output.c	Sat Jul 14 16:19:46 2018	(r336282)
@@ -1256,12 +1256,18 @@ ip_ctloutput(struct socket *so, struct sockopt *sopt)
 		switch (sopt->sopt_name) {
 		case IP_OPTIONS:
 		case IP_RETOPTS:
-			if (inp->inp_options)
+			if (inp->inp_options) {
+				unsigned long len = ulmin(inp->inp_options->m_len, sopt->sopt_valsize);
+				struct mbuf *options = malloc(len, M_TEMP, M_WAITOK);
+				INP_RLOCK(inp);
+				bcopy(inp->inp_options, options, len);
+				INP_RUNLOCK(inp);
 				error = sooptcopyout(sopt,
-						     mtod(inp->inp_options,
+						     mtod(options,
 							  char *),
-						     inp->inp_options->m_len);
-			else
+						     len);
+				free(options, M_TEMP);
+			} else
 				sopt->sopt_valsize = 0;
 			break;