Author: tuexen
Date: Sat May 16 19:26:39 2020
New Revision: 361116
URL: https://svnweb.freebsd.org/changeset/base/361116
Log:
Ensure that an stcb is not dereferenced when it is about to be
freed.
This issue was found by SYZKALLER.
MFC after: 3 days
Modified:
head/sys/netinet/sctp_indata.c
head/sys/netinet/sctp_indata.h
Modified: head/sys/netinet/sctp_indata.c
==============================================================================
--- head/sys/netinet/sctp_indata.c Sat May 16 18:49:37 2020
(r361115)
+++ head/sys/netinet/sctp_indata.c Sat May 16 19:26:39 2020
(r361116)
@@ -164,6 +164,9 @@ sctp_build_readq_entry(struct sctp_tcb *stcb,
read_queue_e->data = dm;
read_queue_e->stcb = stcb;
read_queue_e->port_from = stcb->rport;
+ if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
+ read_queue_e->do_not_ref_stcb = 1;
+ }
failed_build:
return (read_queue_e);
}
@@ -775,6 +778,7 @@ sctp_build_readq_entry_from_ctl(struct sctp_queued_to_
atomic_add_int(&nc->whoFrom->ref_count, 1);
nc->stcb = control->stcb;
nc->port_from = control->port_from;
+ nc->do_not_ref_stcb = control->do_not_ref_stcb;
}
static void
Modified: head/sys/netinet/sctp_indata.h
==============================================================================
--- head/sys/netinet/sctp_indata.h Sat May 16 18:49:37 2020
(r361115)
+++ head/sys/netinet/sctp_indata.h Sat May 16 19:26:39 2020
(r361116)
@@ -68,6 +68,9 @@ sctp_build_readq_entry(struct sctp_tcb *stcb,
(_ctl)->data = dm; \
(_ctl)->stcb = (in_it); \
(_ctl)->port_from = (in_it)->rport; \
+ if ((in_it)->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { \
+ (_ctl)->do_not_ref_stcb = 1; \
+ }\
} \
} while (0)
_______________________________________________
[email protected] mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "[email protected]"
