diff options
author | trociny <trociny@FreeBSD.org> | 2013-07-04 18:38:00 +0000 |
---|---|---|
committer | trociny <trociny@FreeBSD.org> | 2013-07-04 18:38:00 +0000 |
commit | 9b554dcd02e15b115e6aa09edcc4ed77c2019510 (patch) | |
tree | f6485fb13d90580d752059a2e181f32f133bfd6b /sys/netinet/ip_output.c | |
parent | 07bf5c56bffe08987c8c60f43587bd72a13cb0cd (diff) | |
download | FreeBSD-src-9b554dcd02e15b115e6aa09edcc4ed77c2019510.zip FreeBSD-src-9b554dcd02e15b115e6aa09edcc4ed77c2019510.tar.gz |
In r227207, to fix the issue with possible NULL inp_socket pointer
dereferencing, when checking for SO_REUSEPORT option (and SO_REUSEADDR
for multicast), INP_REUSEPORT flag was introduced to cache the socket
option. It was decided then that one flag would be enough to cache
both SO_REUSEPORT and SO_REUSEADDR: when processing SO_REUSEADDR
setsockopt(2), it was checked if it was called for a multicast address
and INP_REUSEPORT was set accordingly.
Unfortunately that approach does not work when setsockopt(2) is called
before binding to a multicast address: the multicast check fails and
INP_REUSEPORT is not set.
Fix this by adding INP_REUSEADDR flag to unconditionally cache
SO_REUSEADDR.
PR: 179901
Submitted by: Michael Gmelin freebsd grem.de (initial version)
Reviewed by: rwatson
MFC after: 1 week
Diffstat (limited to 'sys/netinet/ip_output.c')
-rw-r--r-- | sys/netinet/ip_output.c | 11 |
1 files changed, 4 insertions, 7 deletions
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c index 21d47f7..d835bd2 100644 --- a/sys/netinet/ip_output.c +++ b/sys/netinet/ip_output.c @@ -900,13 +900,10 @@ ip_ctloutput(struct socket *so, struct sockopt *sopt) switch (sopt->sopt_name) { case SO_REUSEADDR: INP_WLOCK(inp); - if (IN_MULTICAST(ntohl(inp->inp_laddr.s_addr))) { - if ((so->so_options & - (SO_REUSEADDR | SO_REUSEPORT)) != 0) - inp->inp_flags2 |= INP_REUSEPORT; - else - inp->inp_flags2 &= ~INP_REUSEPORT; - } + if ((so->so_options & SO_REUSEADDR) != 0) + inp->inp_flags2 |= INP_REUSEADDR; + else + inp->inp_flags2 &= ~INP_REUSEADDR; INP_WUNLOCK(inp); error = 0; break; |