Fix a use-after-free bug for the userland stack. The kernel
stack is not affected. Thanks to Mark Wodrich from Google for finding and reporting the bug. MFC after: 1 week
This commit is contained in:
parent
0d266dedf7
commit
6ddc843832
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=363076
@ -1700,6 +1700,7 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
|
|||||||
int *break_flag, int last_chunk, uint8_t chk_type)
|
int *break_flag, int last_chunk, uint8_t chk_type)
|
||||||
{
|
{
|
||||||
struct sctp_tmit_chunk *chk = NULL; /* make gcc happy */
|
struct sctp_tmit_chunk *chk = NULL; /* make gcc happy */
|
||||||
|
struct sctp_stream_in *strm;
|
||||||
uint32_t tsn, fsn, gap, mid;
|
uint32_t tsn, fsn, gap, mid;
|
||||||
struct mbuf *dmbuf;
|
struct mbuf *dmbuf;
|
||||||
int the_len;
|
int the_len;
|
||||||
@ -2327,12 +2328,13 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
|
|||||||
/* All can be removed */
|
/* All can be removed */
|
||||||
TAILQ_FOREACH_SAFE(control, &asoc->pending_reply_queue, next, ncontrol) {
|
TAILQ_FOREACH_SAFE(control, &asoc->pending_reply_queue, next, ncontrol) {
|
||||||
TAILQ_REMOVE(&asoc->pending_reply_queue, control, next);
|
TAILQ_REMOVE(&asoc->pending_reply_queue, control, next);
|
||||||
|
strm = &asoc->strmin[control->sinfo_stream];
|
||||||
sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
|
sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
|
||||||
if (*abort_flag) {
|
if (*abort_flag) {
|
||||||
return (0);
|
return (0);
|
||||||
}
|
}
|
||||||
if (need_reasm_check) {
|
if (need_reasm_check) {
|
||||||
(void)sctp_deliver_reasm_check(stcb, asoc, &asoc->strmin[control->sinfo_stream], SCTP_READ_LOCK_NOT_HELD);
|
(void)sctp_deliver_reasm_check(stcb, asoc, strm, SCTP_READ_LOCK_NOT_HELD);
|
||||||
need_reasm_check = 0;
|
need_reasm_check = 0;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@ -2347,12 +2349,13 @@ sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
|
|||||||
* control->sinfo_tsn > liste->tsn
|
* control->sinfo_tsn > liste->tsn
|
||||||
*/
|
*/
|
||||||
TAILQ_REMOVE(&asoc->pending_reply_queue, control, next);
|
TAILQ_REMOVE(&asoc->pending_reply_queue, control, next);
|
||||||
|
strm = &asoc->strmin[control->sinfo_stream];
|
||||||
sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
|
sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
|
||||||
if (*abort_flag) {
|
if (*abort_flag) {
|
||||||
return (0);
|
return (0);
|
||||||
}
|
}
|
||||||
if (need_reasm_check) {
|
if (need_reasm_check) {
|
||||||
(void)sctp_deliver_reasm_check(stcb, asoc, &asoc->strmin[control->sinfo_stream], SCTP_READ_LOCK_NOT_HELD);
|
(void)sctp_deliver_reasm_check(stcb, asoc, strm, SCTP_READ_LOCK_NOT_HELD);
|
||||||
need_reasm_check = 0;
|
need_reasm_check = 0;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user