Author: mmacy
Date: Thu Jun 21 17:24:10 2018
New Revision: 335497
URL: https://svnweb.freebsd.org/changeset/base/335497
Log:
raw_ip: validate inp
Post r335356 it is possible to have an inpcb on the hash lists that is
partially torn down. Validate before using.
Reported by: pho
Modified:
head/sys/netinet/raw_ip.c
Modified: head/sys/netinet/raw_ip.c
==============================================================================
--- head/sys/netinet/raw_ip.c Thu Jun 21 17:05:31 2018 (r335496)
+++ head/sys/netinet/raw_ip.c Thu Jun 21 17:24:10 2018 (r335497)
@@ -331,6 +331,10 @@ rip_input(struct mbuf **mp, int *offp, int proto)
}
INP_RLOCK(inp);
last = inp;
+ if (__predict_false(inp->inp_flags2 & INP_FREED)) {
+ last = NULL;
+ INP_RUNLOCK(inp);
+ }
}
CK_LIST_FOREACH(inp, &V_ripcbinfo.ipi_hashbase[0], inp_hash) {
if (inp->inp_ip_p && inp->inp_ip_p != proto)
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
