markj dde1b5985f Properly handle disconnected sockets in uipc_ready().
When transmitting over a unix socket, data is placed directly into the
receiving socket's receive buffer, instead of the transmitting socket's
send buffer.  This means that when pru_ready is called during
sendfile(), the passed socket does not contain M_NOTREADY mbufs in its
buffers; uipc_ready() must locate the linked socket.

Currently uipc_ready() frees the mbufs if the socket is disconnected,
but this is wrong since the mbufs may still be present in the receiving
socket's buffer after a disconnect.  This can result in a use-after-free
and potentially a double free if the receive buffer is flushed after
uipc_ready() frees the mbufs.

Fix the problem by trying harder to locate the correct socket buffer and
calling sbready(): use the global list of SOCK_STREAM unix sockets to
search for a sockbuf containing the now-ready mbufs.  Only free the
mbufs if we fail this search.

Reviewed by:	jah, kib
Reported and tested by:	pho
MFC after:	1 week
Sponsored by:	The FreeBSD Foundation
Differential Revision:	https://reviews.freebsd.org/D24332
2020-04-10 20:41:59 +00:00
..
2020-02-26 16:22:28 +00:00
2020-02-15 01:30:13 +00:00
2020-03-17 22:27:16 +00:00
2019-09-03 18:56:25 +00:00
2020-03-02 15:30:52 +00:00
2020-03-02 15:30:52 +00:00
2020-03-02 15:30:52 +00:00
2020-03-02 15:30:52 +00:00
2019-03-12 05:10:41 +00:00
2018-10-12 00:32:45 +00:00
2020-03-02 15:30:52 +00:00
2019-02-20 09:38:19 +00:00
2020-02-03 17:35:11 +00:00
2020-01-12 23:52:16 +00:00
2020-03-20 20:09:00 +00:00
2020-02-20 16:58:19 +00:00
2020-02-15 01:28:42 +00:00
2020-03-30 21:42:46 +00:00
2020-02-15 01:28:42 +00:00
2020-02-23 03:32:11 +00:00