DF-2978
do_setopt_accept_filter() saves the filter NAME as so_accept_filter_str instead of the user's af_arg — getsockopt(SO_ACCEPTFILTER) returns the name as the argument; latent divergence from FreeBSD (functional, dead in-tree)
| Field | Value |
|---|---|
| ID | DF-2978 |
| Status | new |
| Severity | Info |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N |
| CWE | CWE-628 |
| File | sys/kern/uipc_socket.c |
| Lines | 2043-2049 (found in uipc_accf.c pass-2 sweep) |
| Area | kern/net |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
do_setopt_accept_filter allocates strlen(afap->af_name)+1 and strcpy's afap->af_NAME into so_accept_filter_str, but the field is documented and consumed as the saved user ARGument: sogetopt copies it back into afap->af_arg and FreeBSD's version stores afap->af_arg. The block is guarded by accf_create != NULL, and both in-tree filters set accf_create/destroy to NULL, so the bug is dead code in-tree — but any kld defining accf_create gets its per-socket argument string silently replaced by the filter name (breaks filter configuration round-tripping; the accf_create callback itself still receives the correct af_arg). No memory-safety impact. Fix: one-word change to af_arg (row diff).
Timeline
- 2026-09-02 Discovered during pass-2 audit of uipc_accf.c (GLM 5.3). DF-0248 re-verified still present, not re-reported.
No comments yet.