svn commit: r361116 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Sat May 16 19:26:39 2020
New Revision: 361116
URL: https://svnweb.freebsd.org/changeset/base/361116

Log:
  Ensure that an stcb is not dereferenced when it is about to be
  freed.
  This issue was found by SYZKALLER.
  
  MFC after:		3 days

Modified:
  head/sys/netinet/sctp_indata.c
  head/sys/netinet/sctp_indata.h

Modified: head/sys/netinet/sctp_indata.c
==============================================================================
--- head/sys/netinet/sctp_indata.c	Sat May 16 18:49:37 2020	(r361115)
+++ head/sys/netinet/sctp_indata.c	Sat May 16 19:26:39 2020	(r361116)
@@ -164,6 +164,9 @@ sctp_build_readq_entry(struct sctp_tcb *stcb,
 	read_queue_e->data = dm;
 	read_queue_e->stcb = stcb;
 	read_queue_e->port_from = stcb->rport;
+	if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
+		read_queue_e->do_not_ref_stcb = 1;
+	}
 failed_build:
 	return (read_queue_e);
 }
@@ -775,6 +778,7 @@ sctp_build_readq_entry_from_ctl(struct sctp_queued_to_
 	atomic_add_int(&nc->whoFrom->ref_count, 1);
 	nc->stcb = control->stcb;
 	nc->port_from = control->port_from;
+	nc->do_not_ref_stcb = control->do_not_ref_stcb;
 }
 
 static void

Modified: head/sys/netinet/sctp_indata.h
==============================================================================
--- head/sys/netinet/sctp_indata.h	Sat May 16 18:49:37 2020	(r361115)
+++ head/sys/netinet/sctp_indata.h	Sat May 16 19:26:39 2020	(r361116)
@@ -68,6 +68,9 @@ sctp_build_readq_entry(struct sctp_tcb *stcb,
 		(_ctl)->data = dm; \
 		(_ctl)->stcb = (in_it); \
 		(_ctl)->port_from = (in_it)->rport; \
+		if ((in_it)->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { \
+			(_ctl)->do_not_ref_stcb = 1; \
+		}\
 	} \
 } while (0)