Author: mmacy Date: Thu Jun 21 17:24:10 2018 New Revision: 335497 URL: https://svnweb.freebsd.org/changeset/base/335497
Log: raw_ip: validate inp Post r335356 it is possible to have an inpcb on the hash lists that is partially torn down. Validate before using. Reported by: pho Modified: head/sys/netinet/raw_ip.c Modified: head/sys/netinet/raw_ip.c ============================================================================== --- head/sys/netinet/raw_ip.c Thu Jun 21 17:05:31 2018 (r335496) +++ head/sys/netinet/raw_ip.c Thu Jun 21 17:24:10 2018 (r335497) @@ -331,6 +331,10 @@ rip_input(struct mbuf **mp, int *offp, int proto) } INP_RLOCK(inp); last = inp; + if (__predict_false(inp->inp_flags2 & INP_FREED)) { + last = NULL; + INP_RUNLOCK(inp); + } } CK_LIST_FOREACH(inp, &V_ripcbinfo.ipi_hashbase[0], inp_hash) { if (inp->inp_ip_p && inp->inp_ip_p != proto) _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"