diff options
| author | Claudio Jeker <claudio@cvs.openbsd.org> | 2018-11-21 16:50:50 +0000 |
|---|---|---|
| committer | Claudio Jeker <claudio@cvs.openbsd.org> | 2018-11-21 16:50:50 +0000 |
| commit | cedd79da68cfed8bf4a1d1cab59449ddf2ae7e6e (patch) | |
| tree | c715526f37ce2aba9f441f00ba999433198e82de /sys/kern/uipc_usrreq.c | |
| parent | 0938e5da3a603b8c340e9d228b80b002916f9df6 (diff) | |
When using MSG_PEEK to peak into packets skip control messages holding
SCM_RIGHTS from being sent to the userland since they hold kernel internal
data and it does not make sense to externalize it.
OK deraadt@, guenther@, visa@
Diffstat (limited to 'sys/kern/uipc_usrreq.c')
| -rw-r--r-- | sys/kern/uipc_usrreq.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c index e9a6167c6f3..bd819c07086 100644 --- a/sys/kern/uipc_usrreq.c +++ b/sys/kern/uipc_usrreq.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uipc_usrreq.c,v 1.135 2018/11/09 14:14:31 claudio Exp $ */ +/* $OpenBSD: uipc_usrreq.c,v 1.136 2018/11/21 16:50:49 claudio Exp $ */ /* $NetBSD: uipc_usrreq.c,v 1.18 1996/02/09 19:00:50 christos Exp $ */ /* @@ -663,6 +663,13 @@ unp_externalize(struct mbuf *rights, socklen_t controllen, int flags) struct file *fp; int nfds, error = 0; + /* + * This code only works because SCM_RIGHTS is the only supported + * control message type on unix sockets. Enforce this here. + */ + if (cm->cmsg_type != SCM_RIGHTS || cm->cmsg_level != SOL_SOCKET) + return EINVAL; + nfds = (cm->cmsg_len - CMSG_ALIGN(sizeof(*cm))) / sizeof(struct fdpass); if (controllen < CMSG_ALIGN(sizeof(struct cmsghdr))) |