]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
If a user closes the socket before we call tcp_usr_abort(), then
authorjtl <jtl@FreeBSD.org>
Fri, 6 Apr 2018 17:20:37 +0000 (17:20 +0000)
committerjtl <jtl@FreeBSD.org>
Fri, 6 Apr 2018 17:20:37 +0000 (17:20 +0000)
commitc40b31d1bf78531f20fdc0e36861bcbdd61feba6
tree3d9770ffbdb8d0f8ac42b76610b5c9bbf5907b12
parent013f31df9d02fd1b7e16a49df79b6b1c4b5c8459
If a user closes the socket before we call tcp_usr_abort(), then
tcp_drop() may unlock the INP.  Currently, tcp_usr_abort() does not
check for this case, which results in a panic while trying to unlock
the already-unlocked INP (not to mention, a use-after-free violation).

Make tcp_usr_abort() check the return value of tcp_drop(). In the case
where tcp_drop() returns NULL, tcp_usr_abort() can skip further steps
to abort the connection and simply unlock the INP_INFO lock prior to
returning.

Reviewed by: glebius
MFC after: 2 weeks
Sponsored by: Netflix, Inc.
sys/netinet/tcp_usrreq.c