File CVE-2025-48367.patch of Package redis.39841

From c76d6182096cbe10bd3a1dc41095b5ab422e6a74 Mon Sep 17 00:00:00 2001
From: Ozan Tezcan <ozantezcan@gmail.com>
Date: Wed, 14 May 2025 11:02:30 +0300
Subject: [PATCH] Retry accept() even if accepted connection reports an error
 (CVE-2025-48367)

In case of accept4() returns an error, we should check errno value and
decide if we should retry accept4() without waiting next event loop iteration.
---
 src/anet.c    | 24 ++++++++++++++++++++++++
 src/anet.h    |  1 +
 src/cluster.c |  2 ++
 src/socket.c  |  2 ++
 src/tls.c     |  2 ++
 src/unix.c    |  2 ++
 6 files changed, 33 insertions(+)

diff --git a/src/anet.c b/src/anet.c
index 64824a23f84..6c539d5c122 100644
--- a/src/anet.c
+++ b/src/anet.c
@@ -704,3 +704,27 @@ int anetIsFifo(char *filepath) {
     if (stat(filepath, &sb) == -1) return 0;
     return S_ISFIFO(sb.st_mode);
 }
+
+/* This function must be called after accept4() fails. It returns 1 if 'err'
+ * indicates accepted connection faced an error, and it's okay to continue
+ * accepting next connection by calling accept4() again. Other errors either
+ * indicate programming errors, e.g. calling accept() on a closed fd or indicate
+ * a resource limit has been reached, e.g. -EMFILE, open fd limit has been
+ * reached. In the latter case, caller might wait until resources are available.
+ * See accept4() documentation for details. */
+int anetAcceptFailureNeedsRetry(int err) {
+    if (err == ECONNABORTED)
+        return 1;
+
+#if defined(__linux__)
+    /* For details, see 'Error Handling' section on
+     * https://man7.org/linux/man-pages/man2/accept.2.html */
+    if (err == ENETDOWN || err == EPROTO || err == ENOPROTOOPT ||
+        err == EHOSTDOWN || err == ENONET || err == EHOSTUNREACH ||
+        err == EOPNOTSUPP || err == ENETUNREACH)
+    {
+        return 1;
+    }
+#endif
+    return 0;
+}
diff --git a/src/anet.h b/src/anet.h
index b13c14f7758..23190394f6f 100644
--- a/src/anet.h
+++ b/src/anet.h
@@ -71,5 +71,6 @@ int anetPipe(int fds[2], int read_flags, int write_flags);
 int anetSetSockMarkId(char *err, int fd, uint32_t id);
 int anetGetError(int fd);
 int anetIsFifo(char *filepath);
+int anetAcceptFailureNeedsRetry(int err);
 
 #endif
diff --git a/src/cluster.c b/src/cluster.c
index f929392639a..f04e6d185b3 100644
--- a/src/cluster.c
+++ b/src/cluster.c
@@ -1314,6 +1314,8 @@ void clusterAcceptHandler(aeEventLoop *el, int fd, void *privdata, int mask) {
     while(max--) {
         cfd = anetTcpAccept(server.neterr, fd, cip, sizeof(cip), &cport);
         if (cfd == ANET_ERR) {
+            if (anetAcceptFailureNeedsRetry(errno))
+                continue;
             if (errno != EWOULDBLOCK)
                 serverLog(LL_VERBOSE,
                     "Error accepting cluster node: %s", server.neterr);
diff --git a/src/socket.c b/src/socket.c
index dad8e93cca5..09d87bce47f 100644
--- a/src/socket.c
+++ b/src/socket.c
@@ -318,6 +318,8 @@ static void connSocketAcceptHandler(aeEventLoop *el, int fd, void *privdata, int
     while(max--) {
         cfd = anetTcpAccept(server.neterr, fd, cip, sizeof(cip), &cport);
         if (cfd == ANET_ERR) {
+            if (anetAcceptFailureNeedsRetry(errno))
+                continue;
             if (errno != EWOULDBLOCK)
                 serverLog(LL_WARNING,
                     "Accepting client connection: %s", server.neterr);
diff --git a/src/tls.c b/src/tls.c
index e709c99309d..9a66e810efb 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -774,6 +774,8 @@ static void tlsAcceptHandler(aeEventLoop *el, int fd, void *privdata, int mask)
     while(max--) {
         cfd = anetTcpAccept(server.neterr, fd, cip, sizeof(cip), &cport);
         if (cfd == ANET_ERR) {
+            if (anetAcceptFailureNeedsRetry(errno))
+                continue;
             if (errno != EWOULDBLOCK)
                 serverLog(LL_WARNING,
                     "Accepting client connection: %s", server.neterr);
diff --git a/src/unix.c b/src/unix.c
index bd146d0245e..8fdefe41823 100644
--- a/src/unix.c
+++ b/src/unix.c
@@ -100,6 +100,8 @@ static void connUnixAcceptHandler(aeEventLoop *el, int fd, void *privdata, int m
     while(max--) {
         cfd = anetUnixAccept(server.neterr, fd);
         if (cfd == ANET_ERR) {
+            if (anetAcceptFailureNeedsRetry(errno))
+                continue;
             if (errno != EWOULDBLOCK)
                 serverLog(LL_WARNING,
                     "Accepting client connection: %s", server.neterr);