d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

After removing an entry from the stream scheduler list, set the pointers

Browse Source 
to NULL, since we are checking for it in case the element gets inserted
again.

This issue was found by running syzkaller.

MFC after:		3 days
This commit is contained in:
Michael Tuexen 2019-03-07 08:43:20 +00:00
parent 058250a8ab
commit e6dcce69ca
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=344872
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
sys/netinet/sctp_ss_functions.c
View File

@ -78,9 +78,10 @@ sctp_ss_default_clear(struct sctp_tcb *stcb, struct sctp_association *asoc,
SCTP_TCB_SEND_LOCK(stcb);
}
while (!TAILQ_EMPTY(&asoc->ss_data.out.wheel)) {
struct sctp_stream_out *strq = TAILQ_FIRST(&asoc->ss_data.out.wheel);
struct sctp_stream_out *strq;
TAILQ_REMOVE(&asoc->ss_data.out.wheel, TAILQ_FIRST(&asoc->ss_data.out.wheel), ss_params.rr.next_spoke);
strq = TAILQ_FIRST(&asoc->ss_data.out.wheel);
TAILQ_REMOVE(&asoc->ss_data.out.wheel, strq, ss_params.rr.next_spoke);
strq->ss_params.rr.next_spoke.tqe_next = NULL;
strq->ss_params.rr.next_spoke.tqe_prev = NULL;
}
@ -793,12 +794,17 @@ static void
sctp_ss_fcfs_clear(struct sctp_tcb *stcb, struct sctp_association *asoc,
int clear_values, int holds_lock)
{
struct sctp_stream_queue_pending *sp;
if (clear_values) {
if (holds_lock == 0) {
SCTP_TCB_SEND_LOCK(stcb);
}
while (!TAILQ_EMPTY(&asoc->ss_data.out.list)) {
TAILQ_REMOVE(&asoc->ss_data.out.list, TAILQ_FIRST(&asoc->ss_data.out.list), ss_next);
sp = TAILQ_FIRST(&asoc->ss_data.out.list);
TAILQ_REMOVE(&asoc->ss_data.out.list, sp, ss_next);
sp->ss_next.tqe_next = NULL;
sp->ss_next.tqe_prev = NULL;
}
if (holds_lock == 0) {
SCTP_TCB_SEND_UNLOCK(stcb);
@ -861,6 +867,8 @@ sctp_ss_fcfs_remove(struct sctp_tcb *stcb, struct sctp_association *asoc,
((sp->ss_next.tqe_next != NULL) ||
(sp->ss_next.tqe_prev != NULL))) {
TAILQ_REMOVE(&asoc->ss_data.out.list, sp, ss_next);
sp->ss_next.tqe_next = NULL;
sp->ss_next.tqe_prev = NULL;
}
if (holds_lock == 0) {
SCTP_TCB_SEND_UNLOCK(stcb);