svn commit: r363456 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Thu Jul 23 19:43:49 2020
New Revision: 363456
URL: https://svnweb.freebsd.org/changeset/base/363456

Log:
  Clear the pointer to the socket when closing it also in case of
  an ungraceful operation.
  This fixes a use-after-free bug found and reported by Taylor
  Brandstetter of Google by testing the userland stack.
  
  MFC after:		1 week

Modified:
  head/sys/netinet/sctp_pcb.c

Modified: head/sys/netinet/sctp_pcb.c
==============================================================================
--- head/sys/netinet/sctp_pcb.c	Thu Jul 23 19:19:33 2020	(r363455)
+++ head/sys/netinet/sctp_pcb.c	Thu Jul 23 19:43:49 2020	(r363456)
@@ -3545,6 +3545,11 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate,
 	cnt = 0;
 	LIST_FOREACH_SAFE(asoc, &inp->sctp_asoc_list, sctp_tcblist, nasoc) {
 		SCTP_TCB_LOCK(asoc);
+		if (immediate != SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
+			/* Disconnect the socket please */
+			asoc->sctp_socket = NULL;
+			SCTP_ADD_SUBSTATE(asoc, SCTP_STATE_CLOSED_SOCKET);
+		}
 		if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
 			if (asoc->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
 				SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_IN_ACCEPT_QUEUE);