Author: tuexen
Date: Mon Aug 24 09:15:52 2020
New Revision: 364643
URL: https://svnweb.freebsd.org/changeset/base/364643
Log:
MFC r363456:
Clear the pointer to the socket when closing it also in case of
an ungraceful operation.
This fixes a use-after-free bug found and reported by Taylor
Brandstetter of Google by testing the userland stack.
Modified:
stable/12/sys/netinet/sctp_pcb.c
Directory Properties:
stable/12/ (props changed)
Modified: stable/12/sys/netinet/sctp_pcb.c
==============================================================================
--- stable/12/sys/netinet/sctp_pcb.c Mon Aug 24 09:14:32 2020
(r364642)
+++ stable/12/sys/netinet/sctp_pcb.c Mon Aug 24 09:15:52 2020
(r364643)
@@ -3545,6 +3545,11 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate,
cnt = 0;
LIST_FOREACH_SAFE(asoc, &inp->sctp_asoc_list, sctp_tcblist, nasoc) {
SCTP_TCB_LOCK(asoc);
+ if (immediate != SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
+ /* Disconnect the socket please */
+ asoc->sctp_socket = NULL;
+ SCTP_ADD_SUBSTATE(asoc, SCTP_STATE_CLOSED_SOCKET);
+ }
if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
if (asoc->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
SCTP_CLEAR_SUBSTATE(asoc,
SCTP_STATE_IN_ACCEPT_QUEUE);
_______________________________________________
svn-src-all@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
