Module Name: src Committed By: bouyer Date: Sat Dec 14 19:37:02 UTC 2013
Modified Files: src/sys/kern [netbsd-6-0]: uipc_syscalls.c Log Message: Pull up following revision(s) (requested by spz in ticket #996): sys/kern/uipc_syscalls.c: revision 1.163 PR/47591: Michael Plass: If the unix socket is closed before accept, unp->unp_conn will be NULL in PRU_ACCEPT, as called from sys_accept->so_accept. This will cause the usrreq to return with no error, leaving the mbuf gotten from m_get() with an uninitialized length, containing junk from a previous call. Initialize m_len to be 0 to handle this case. This is yet another reason why Beverly's idea of setting m_len = 0 in m_get() makes a lot of sense. Arguably this could be an error, since the data we return now has 0 family and length. To generate a diff of this commit: cvs rdiff -u -r1.154.2.1.4.1 -r1.154.2.1.4.2 src/sys/kern/uipc_syscalls.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/kern/uipc_syscalls.c diff -u src/sys/kern/uipc_syscalls.c:1.154.2.1.4.1 src/sys/kern/uipc_syscalls.c:1.154.2.1.4.2 --- src/sys/kern/uipc_syscalls.c:1.154.2.1.4.1 Mon Jan 7 16:53:36 2013 +++ src/sys/kern/uipc_syscalls.c Sat Dec 14 19:37:02 2013 @@ -1,4 +1,4 @@ -/* $NetBSD: uipc_syscalls.c,v 1.154.2.1.4.1 2013/01/07 16:53:36 riz Exp $ */ +/* $NetBSD: uipc_syscalls.c,v 1.154.2.1.4.2 2013/12/14 19:37:02 bouyer Exp $ */ /*- * Copyright (c) 2008, 2009 The NetBSD Foundation, Inc. @@ -61,7 +61,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.154.2.1.4.1 2013/01/07 16:53:36 riz Exp $"); +__KERNEL_RCSID(0, "$NetBSD: uipc_syscalls.c,v 1.154.2.1.4.2 2013/12/14 19:37:02 bouyer Exp $"); #include "opt_pipe.h" @@ -184,6 +184,7 @@ do_sys_accept(struct lwp *l, int sock, s return (error); } nam = m_get(M_WAIT, MT_SONAME); + nam->m_len = 0; *new_sock = fd; so = fp->f_data; solock(so);