svn commit: r332120 - head/sys/netinet

[Jonathan T. Looney]

Author: jtl
Date: Fri Apr  6 17:20:37 2018
New Revision: 332120
URL: https://svnweb.freebsd.org/changeset/base/332120

Log:
  If a user closes the socket before we call tcp_usr_abort(), then
  tcp_drop() may unlock the INP.  Currently, tcp_usr_abort() does not
  check for this case, which results in a panic while trying to unlock
  the already-unlocked INP (not to mention, a use-after-free violation).
  
  Make tcp_usr_abort() check the return value of tcp_drop(). In the case
  where tcp_drop() returns NULL, tcp_usr_abort() can skip further steps
  to abort the connection and simply unlock the INP_INFO lock prior to
  returning.
  
  Reviewed by:	glebius
  MFC after:	2 weeks
  Sponsored by:	Netflix, Inc.

Modified:
  head/sys/netinet/tcp_usrreq.c

Modified: head/sys/netinet/tcp_usrreq.c
==============================================================================
--- head/sys/netinet/tcp_usrreq.c	Fri Apr  6 17:17:34 2018	(r332119)
+++ head/sys/netinet/tcp_usrreq.c	Fri Apr  6 17:20:37 2018	(r332120)
@@ -1095,7 +1095,9 @@ tcp_usr_abort(struct socket *so)
 	    !(inp->inp_flags & INP_DROPPED)) {
 		tp = intotcpcb(inp);
 		TCPDEBUG1();
-		tcp_drop(tp, ECONNABORTED);
+		tp = tcp_drop(tp, ECONNABORTED);
+		if (tp == NULL)
+			goto dropped;
 		TCPDEBUG2(PRU_ABORT);
 		TCP_PROBE2(debug__user, tp, PRU_ABORT);
 	}
@@ -1106,6 +1108,7 @@ tcp_usr_abort(struct socket *so)
 		inp->inp_flags |= INP_SOCKREF;
 	}
 	INP_WUNLOCK(inp);
+dropped:
 	INP_INFO_RUNLOCK(&V_tcbinfo);
 }