svn commit: r346197 - head/sys/net
Michael Tuexen
tuexen at FreeBSD.org
Sun Apr 14 10:18:15 UTC 2019
Author: tuexen
Date: Sun Apr 14 10:18:14 2019
New Revision: 346197
URL: https://svnweb.freebsd.org/changeset/base/346197
Log:
When sending a routing message, don't allow the user to set the
RTF_RNH_LOCKED flag in rtm_flags, since this flag is used only
internally.
Reported by: syzbot+65c676f5248a13753ea0 at syzkaller.appspotmail.com
Reviewed by: ae@
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D19898
Modified:
head/sys/net/rtsock.c
Modified: head/sys/net/rtsock.c
==============================================================================
--- head/sys/net/rtsock.c Sun Apr 14 00:06:49 2019 (r346196)
+++ head/sys/net/rtsock.c Sun Apr 14 10:18:14 2019 (r346197)
@@ -618,6 +618,8 @@ route_output(struct mbuf *m, struct socket *so, ...)
if (rt_xaddrs((caddr_t)(rtm + 1), len + (caddr_t)rtm, &info))
senderr(EINVAL);
+ if (rtm->rtm_flags & RTF_RNH_LOCKED)
+ senderr(EINVAL);
info.rti_flags = rtm->rtm_flags;
if (info.rti_info[RTAX_DST] == NULL ||
info.rti_info[RTAX_DST]->sa_family >= AF_MAX ||
More information about the svn-src-all
mailing list