Author: tuexen
Date: Fri May 29 13:23:16 2015
New Revision: 283734
URL: https://svnweb.freebsd.org/changeset/base/283734

Log:
  MFC r280642:
  
  Make sure that we don't free an SCTP shared key too early.
  Thanks to Pouyan Sepehrdad from Qualcomm Product Security Initiative
  for reporting the issue.

Modified:
  stable/10/sys/netinet/sctp_auth.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netinet/sctp_auth.c
==============================================================================
--- stable/10/sys/netinet/sctp_auth.c   Fri May 29 13:20:39 2015        
(r283733)
+++ stable/10/sys/netinet/sctp_auth.c   Fri May 29 13:23:16 2015        
(r283734)
@@ -576,13 +576,12 @@ sctp_auth_key_release(struct sctp_tcb *s
 
        /* decrement the ref count */
        if (skey) {
-               sctp_free_sharedkey(skey);
                SCTPDBG(SCTP_DEBUG_AUTH2,
                    "%s: stcb %p key %u refcount release to %d\n",
                    __FUNCTION__, (void *)stcb, key_id, skey->refcount);
 
                /* see if a notification should be generated */
-               if ((skey->refcount <= 1) && (skey->deactivated)) {
+               if ((skey->refcount <= 2) && (skey->deactivated)) {
                        /* notify ULP that key is no longer used */
                        sctp_ulp_notify(SCTP_NOTIFY_AUTH_FREE_KEY, stcb,
                            key_id, 0, so_locked);
@@ -590,6 +589,7 @@ sctp_auth_key_release(struct sctp_tcb *s
                            "%s: stcb %p key %u no longer used, %d\n",
                            __FUNCTION__, (void *)stcb, key_id, skey->refcount);
                }
+               sctp_free_sharedkey(skey);
        }
 }
 
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"

Reply via email to