Author: tuexen
Date: Thu Jul 23 19:43:49 2020
New Revision: 363456
URL: https://svnweb.freebsd.org/changeset/base/363456
Log:
Clear the pointer to the socket when closing it also in case of
an ungraceful operation.
This fixes a use-after-free bug found and reported by Taylor
Brandstetter of Google by testing the userland stack.
MFC after: 1 week
Modified:
head/sys/netinet/sctp_pcb.c
Modified: head/sys/netinet/sctp_pcb.c
==============================================================================
--- head/sys/netinet/sctp_pcb.c Thu Jul 23 19:19:33 2020 (r363455)
+++ head/sys/netinet/sctp_pcb.c Thu Jul 23 19:43:49 2020 (r363456)
@@ -3545,6 +3545,11 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate,
cnt = 0;
LIST_FOREACH_SAFE(asoc, &inp->sctp_asoc_list, sctp_tcblist, nasoc) {
SCTP_TCB_LOCK(asoc);
+ if (immediate != SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
+ /* Disconnect the socket please */
+ asoc->sctp_socket = NULL;
+ SCTP_ADD_SUBSTATE(asoc, SCTP_STATE_CLOSED_SOCKET);
+ }
if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
if (asoc->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
SCTP_CLEAR_SUBSTATE(asoc,
SCTP_STATE_IN_ACCEPT_QUEUE);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
