d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Ensure that an stcb is not dereferenced when it is about to be

Browse Source 
freed.
This issue was found by SYZKALLER.

MFC after:		3 days
This commit is contained in:
Michael Tuexen 2020-05-16 19:26:39 +00:00
parent 8d3361e9e5
commit daf143413a
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/netinet/sctp_indata.c
View File

@ -164,6 +164,9 @@ sctp_build_readq_entry(struct sctp_tcb *stcb,
read_queue_e->data = dm;
read_queue_e->stcb = stcb;
read_queue_e->port_from = stcb->rport;
if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
read_queue_e->do_not_ref_stcb = 1;
}
failed_build:
return (read_queue_e);
}
@ -775,6 +778,7 @@ sctp_build_readq_entry_from_ctl(struct sctp_queued_to_read *nc, struct sctp_queu
atomic_add_int(&nc->whoFrom->ref_count, 1);
nc->stcb = control->stcb;
nc->port_from = control->port_from;
nc->do_not_ref_stcb = control->do_not_ref_stcb;
}
static void

3
sys/netinet/sctp_indata.h
View File

@ -68,6 +68,9 @@ sctp_build_readq_entry(struct sctp_tcb *stcb,
(_ctl)->data = dm; \
(_ctl)->stcb = (in_it); \
(_ctl)->port_from = (in_it)->rport; \
if ((in_it)->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { \
(_ctl)->do_not_ref_stcb = 1; \
}\
} \
} while (0)