svn commit: r283734 - stable/10/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Fri May 29 13:23:16 2015
New Revision: 283734
URL: https://svnweb.freebsd.org/changeset/base/283734

Log:
  MFC r280642:
  
  Make sure that we don't free an SCTP shared key too early.
  Thanks to Pouyan Sepehrdad from Qualcomm Product Security Initiative
  for reporting the issue.

Modified:
  stable/10/sys/netinet/sctp_auth.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/netinet/sctp_auth.c
==============================================================================
--- stable/10/sys/netinet/sctp_auth.c	Fri May 29 13:20:39 2015	(r283733)
+++ stable/10/sys/netinet/sctp_auth.c	Fri May 29 13:23:16 2015	(r283734)
@@ -576,13 +576,12 @@ sctp_auth_key_release(struct sctp_tcb *s
 
 	/* decrement the ref count */
 	if (skey) {
-		sctp_free_sharedkey(skey);
 		SCTPDBG(SCTP_DEBUG_AUTH2,
 		    "%s: stcb %p key %u refcount release to %d\n",
 		    __FUNCTION__, (void *)stcb, key_id, skey->refcount);
 
 		/* see if a notification should be generated */
-		if ((skey->refcount <= 1) && (skey->deactivated)) {
+		if ((skey->refcount <= 2) && (skey->deactivated)) {
 			/* notify ULP that key is no longer used */
 			sctp_ulp_notify(SCTP_NOTIFY_AUTH_FREE_KEY, stcb,
 			    key_id, 0, so_locked);
@@ -590,6 +589,7 @@ sctp_auth_key_release(struct sctp_tcb *s
 			    "%s: stcb %p key %u no longer used, %d\n",
 			    __FUNCTION__, (void *)stcb, key_id, skey->refcount);
 		}
+		sctp_free_sharedkey(skey);
 	}
 }