svn commit: r361473 - stable/11/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Mon May 25 20:11:26 2020
New Revision: 361473
URL: https://svnweb.freebsd.org/changeset/base/361473

Log:
  MFC r361116: Improve stcb handling during teardown
  
  Ensure that an stcb is not dereferenced when it is about to be
  freed.
  This issue was found by SYZKALLER.

Modified:
  stable/11/sys/netinet/sctp_indata.c
  stable/11/sys/netinet/sctp_indata.h
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet/sctp_indata.c
==============================================================================
--- stable/11/sys/netinet/sctp_indata.c	Mon May 25 20:09:18 2020	(r361472)
+++ stable/11/sys/netinet/sctp_indata.c	Mon May 25 20:11:26 2020	(r361473)
@@ -162,6 +162,9 @@ sctp_build_readq_entry(struct sctp_tcb *stcb,
 	read_queue_e->data = dm;
 	read_queue_e->stcb = stcb;
 	read_queue_e->port_from = stcb->rport;
+	if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
+		read_queue_e->do_not_ref_stcb = 1;
+	}
 failed_build:
 	return (read_queue_e);
 }
@@ -773,6 +776,7 @@ sctp_build_readq_entry_from_ctl(struct sctp_queued_to_
 	atomic_add_int(&nc->whoFrom->ref_count, 1);
 	nc->stcb = control->stcb;
 	nc->port_from = control->port_from;
+	nc->do_not_ref_stcb = control->do_not_ref_stcb;
 }
 
 static void

Modified: stable/11/sys/netinet/sctp_indata.h
==============================================================================
--- stable/11/sys/netinet/sctp_indata.h	Mon May 25 20:09:18 2020	(r361472)
+++ stable/11/sys/netinet/sctp_indata.h	Mon May 25 20:11:26 2020	(r361473)
@@ -66,6 +66,9 @@ sctp_build_readq_entry(struct sctp_tcb *stcb,
 		(_ctl)->data = dm; \
 		(_ctl)->stcb = (in_it); \
 		(_ctl)->port_from = (in_it)->rport; \
+		if ((in_it)->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { \
+			(_ctl)->do_not_ref_stcb = 1; \
+		}\
 	} \
 } while (0)