Author: jtl
Date: Fri Apr  6 17:20:37 2018
New Revision: 332120
URL: https://svnweb.freebsd.org/changeset/base/332120

Log:
  If a user closes the socket before we call tcp_usr_abort(), then
  tcp_drop() may unlock the INP.  Currently, tcp_usr_abort() does not
  check for this case, which results in a panic while trying to unlock
  the already-unlocked INP (not to mention, a use-after-free violation).
  
  Make tcp_usr_abort() check the return value of tcp_drop(). In the case
  where tcp_drop() returns NULL, tcp_usr_abort() can skip further steps
  to abort the connection and simply unlock the INP_INFO lock prior to
  returning.
  
  Reviewed by:  glebius
  MFC after:    2 weeks
  Sponsored by: Netflix, Inc.

Modified:
  head/sys/netinet/tcp_usrreq.c

Modified: head/sys/netinet/tcp_usrreq.c
==============================================================================
--- head/sys/netinet/tcp_usrreq.c       Fri Apr  6 17:17:34 2018        
(r332119)
+++ head/sys/netinet/tcp_usrreq.c       Fri Apr  6 17:20:37 2018        
(r332120)
@@ -1095,7 +1095,9 @@ tcp_usr_abort(struct socket *so)
            !(inp->inp_flags & INP_DROPPED)) {
                tp = intotcpcb(inp);
                TCPDEBUG1();
-               tcp_drop(tp, ECONNABORTED);
+               tp = tcp_drop(tp, ECONNABORTED);
+               if (tp == NULL)
+                       goto dropped;
                TCPDEBUG2(PRU_ABORT);
                TCP_PROBE2(debug__user, tp, PRU_ABORT);
        }
@@ -1106,6 +1108,7 @@ tcp_usr_abort(struct socket *so)
                inp->inp_flags |= INP_SOCKREF;
        }
        INP_WUNLOCK(inp);
+dropped:
        INP_INFO_RUNLOCK(&V_tcbinfo);
 }
 
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"

Reply via email to