svn commit: r360744 - stable/11/sys/netinet
Michael Tuexen
tuexen at FreeBSD.org
Thu May 7 02:10:44 UTC 2020
Author: tuexen
Date: Thu May 7 02:10:44 2020
New Revision: 360744
URL: https://svnweb.freebsd.org/changeset/base/360744
Log:
MFC r353123: Fix use afterfreee.
Fix a use after free bug when removing remote addresses.
This bug was found by OSS-Fuzz and reported in
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18004
Modified:
stable/11/sys/netinet/sctp_asconf.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/netinet/sctp_asconf.c
==============================================================================
--- stable/11/sys/netinet/sctp_asconf.c Thu May 7 02:08:44 2020 (r360743)
+++ stable/11/sys/netinet/sctp_asconf.c Thu May 7 02:10:44 2020 (r360744)
@@ -281,7 +281,7 @@ sctp_process_asconf_add_ip(struct sockaddr *src, struc
static int
sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
{
- struct sctp_nets *src_net, *net;
+ struct sctp_nets *src_net, *net, *nnet;
/* make sure the source address exists as a destination net */
src_net = sctp_findnet(stcb, src);
@@ -291,10 +291,9 @@ sctp_asconf_del_remote_addrs_except(struct sctp_tcb *s
}
/* delete all destination addresses except the source */
- TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
+ TAILQ_FOREACH_SAFE(net, &stcb->asoc.nets, sctp_next, nnet) {
if (net != src_net) {
/* delete this address */
- sctp_remove_net(stcb, net);
SCTPDBG(SCTP_DEBUG_ASCONF1,
"asconf_del_remote_addrs_except: deleting ");
SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
@@ -302,6 +301,7 @@ sctp_asconf_del_remote_addrs_except(struct sctp_tcb *s
/* notify upper layer */
sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
(struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
+ sctp_remove_net(stcb, net);
}
}
return (0);
More information about the svn-src-stable
mailing list