svn commit: r335497 - head/sys/netinet

[Matt Macy]

Author: mmacy
Date: Thu Jun 21 17:24:10 2018
New Revision: 335497
URL: https://svnweb.freebsd.org/changeset/base/335497

Log:
  raw_ip: validate inp
  
  Post r335356 it is possible to have an inpcb on the hash lists that is
  partially torn down. Validate before using.
  
  Reported by:	pho

Modified:
  head/sys/netinet/raw_ip.c

Modified: head/sys/netinet/raw_ip.c
==============================================================================
--- head/sys/netinet/raw_ip.c	Thu Jun 21 17:05:31 2018	(r335496)
+++ head/sys/netinet/raw_ip.c	Thu Jun 21 17:24:10 2018	(r335497)
@@ -331,6 +331,10 @@ rip_input(struct mbuf **mp, int *offp, int proto)
 		}
 		INP_RLOCK(inp);
 		last = inp;
+		if (__predict_false(inp->inp_flags2 & INP_FREED)) {
+			last = NULL;
+			INP_RUNLOCK(inp);
+		}
 	}
 	CK_LIST_FOREACH(inp, &V_ripcbinfo.ipi_hashbase[0], inp_hash) {
 		if (inp->inp_ip_p && inp->inp_ip_p != proto)