DragonFlyBSD Kernel Audit
DF-2836 / fix.diff
← back to finding ↓ download raw
--- a/sys/kern/uipc_socket2.c
+++ b/sys/kern/uipc_socket2.c
@@ -380,7 +380,11 @@ sonewconn_faddr(struct socket *head, int connstatus,
 	so->so_options = head->so_options &~ SO_ACCEPTCONN;
 	so->so_linger = head->so_linger;
 
-	so->so_state = head->so_state | SS_NOFDREF | SS_ASSERTINPROG;
+	/*
+	 * Do not inherit the listener's dynamic state (e.g. shutdown
+	 * flags SS_CANTRCVMORE/SS_CANTSENDMORE, SS_ASYNC) -- accepted
+	 * connections must start with a clean state.
+	 */
+	so->so_state = SS_NOFDREF | SS_ASSERTINPROG;
 	so->so_cred = crhold(head->so_cred);
 	ai.sb_rlimit = NULL;
 	ai.p_ucred = NULL;