svn commit: r352509 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Thu Sep 19 10:01:19 2019
New Revision: 352509
URL: https://svnweb.freebsd.org/changeset/base/352509

Log:
  MFC r352438:
  
  Only allow a SCTP-AUTH shared key to be updated by the application
  if it is not deactivated and not used.
  This avoids a use-after-free problem.
  
  Reported by:		da_cheng_shao at yeah.net

Modified:
  stable/12/sys/netinet/sctp_auth.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_auth.c
==============================================================================
--- stable/12/sys/netinet/sctp_auth.c	Thu Sep 19 09:59:37 2019	(r352508)
+++ stable/12/sys/netinet/sctp_auth.c	Thu Sep 19 10:01:19 2019	(r352509)
@@ -523,7 +523,7 @@ sctp_insert_sharedkey(struct sctp_keyhead *shared_keys
 		} else if (new_skey->keyid == skey->keyid) {
 			/* replace the existing key */
 			/* verify this key *can* be replaced */
-			if ((skey->deactivated) && (skey->refcount > 1)) {
+			if ((skey->deactivated) || (skey->refcount > 1)) {
 				SCTPDBG(SCTP_DEBUG_AUTH1,
 				    "can't replace shared key id %u\n",
 				    new_skey->keyid);