Author: tuexen
Date: Wed Mar 25 22:45:54 2015
New Revision: 280642
URL: https://svnweb.freebsd.org/changeset/base/280642
Log:
Make sure that we don't free an SCTP shared key too early.
Thanks to Pouyan Sepehrdad from Qualcomm Product Security Initiative
for reporting the issue.
MFC after: 3 days
Modified:
head/sys/netinet/sctp_auth.c
Modified: head/sys/netinet/sctp_auth.c
==============================================================================
--- head/sys/netinet/sctp_auth.c Wed Mar 25 22:35:08 2015
(r280641)
+++ head/sys/netinet/sctp_auth.c Wed Mar 25 22:45:54 2015
(r280642)
@@ -576,13 +576,12 @@ sctp_auth_key_release(struct sctp_tcb *s
/* decrement the ref count */
if (skey) {
- sctp_free_sharedkey(skey);
SCTPDBG(SCTP_DEBUG_AUTH2,
"%s: stcb %p key %u refcount release to %d\n",
__FUNCTION__, (void *)stcb, key_id, skey->refcount);
/* see if a notification should be generated */
- if ((skey->refcount <= 1) && (skey->deactivated)) {
+ if ((skey->refcount <= 2) && (skey->deactivated)) {
/* notify ULP that key is no longer used */
sctp_ulp_notify(SCTP_NOTIFY_AUTH_FREE_KEY, stcb,
key_id, 0, so_locked);
@@ -590,6 +589,7 @@ sctp_auth_key_release(struct sctp_tcb *s
"%s: stcb %p key %u no longer used, %d\n",
__FUNCTION__, (void *)stcb, key_id, skey->refcount);
}
+ sctp_free_sharedkey(skey);
}
}
_______________________________________________
[email protected] mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "[email protected]"
