From nobody Wed Feb 01 22:29:26 2023 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4P6c6G5nRfz3cCCM; Wed, 1 Feb 2023 22:29:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4P6c6G3jccz4H0y; Wed, 1 Feb 2023 22:29:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1675290566; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Csa+z2BQ+pOc6u/AmLdGJXebCv3PWQVEXoLW0g/iWk0=; b=nI+yjnufUa/uQGAEVOUjXGsn5yNogv3cxEXfTzK+fVFmtOn7MPI8/a0Aiw5idDiX+T12qC HFGIjp78oZwPF8Bhbgu7BVHoTTUblQo2klZuMY8vlBtiA+BErrr0B8KXQQgXQZk7yR5UWs cau/uxdQNVKp7aofdWpw1jnkfCiaiywdRjpEBGHb1a4fvsZbqXqYgSVTe/5adZnt/jWcx9 iniUPRaKr/Yig8ZqwNFj8XAngZWIKeSfNYriLv0+qVXZ+DzrGo6kDaAZjBFoUAz2ENJY8B Bn2WrFehE3T1Ss8ipRD2pnNsKGe9h/GJoEdgqAA0TFfOAF18DJUYA2fj16daZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1675290566; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Csa+z2BQ+pOc6u/AmLdGJXebCv3PWQVEXoLW0g/iWk0=; b=i1PFptoxNMgrtPtnxY+GHI1epm6ySBrKpjCP78Ht+WjStf++G4Of/TL49KVRHHEfZTC1WR LCX8YkUcSTh96ZrZu56Ywss6WCNizkGFISXMngpTy9jP/pz/eQeT21OzLbJmL6ed2mzOXd 0ByRa55slNSY7Wcy5bQRSsD/y2Lfeq5QVz2VOqnrOcIlozz108BDJ18lj7EkU2o9jSeTdH OX8c7HMZXEuMpLAfRsXup36Tn2QyAvkestTILDz3PjZbiVrCzQpfglDh1wThz+P3psQVVJ NRBYk/7CTsaPI+2zq5R2aoCsc1pBeN1ALhDfvNdvoBLiT54+sqL84TG7S1odFQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1675290566; a=rsa-sha256; cv=none; b=euGQTHsmpSSkmjTcrafg35TfxGtWiiTocdwTijEK6aRj4CIJ+qT3Ml3G7NTw11IKHXE8hf dUgivGRWAPlqRBqJsaX2Mxv6Suwkd33529Ta3YRv++6StFh8RIO7Rc+jVmi5kqyf11Erwe nD5x/bRlwkgIhvwM0McdHBZlVuf+DF6r6XFjaHwNlKoMxxpS/WdF9BbV9co4mNKkEYgtyC zTIlZuDGySnxEFlkqstew34CwolZDiyuL2Q3YXe8V2F/yWo6IzCXKPfuyBfOyFWKqOx8jU 2gRdxz93uHQVblWZGspXsVvagMPGPp2h8d+FwfWFyyql/Ykh9lfN0Yy3StRyGg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4P6c6G2SDPzWQN; Wed, 1 Feb 2023 22:29:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 311MTQuR072542; Wed, 1 Feb 2023 22:29:26 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 311MTQZY072541; Wed, 1 Feb 2023 22:29:26 GMT (envelope-from git) Date: Wed, 1 Feb 2023 22:29:26 GMT Message-Id: <202302012229.311MTQZY072541@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Michael Tuexen Subject: git: 2bf685d16aa7 - stable/13 - sctp: clear pointer to stack when returning from function. List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 2bf685d16aa76eb7d93ed0b50aef4183e0ce77ee Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch stable/13 has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=2bf685d16aa76eb7d93ed0b50aef4183e0ce77ee commit 2bf685d16aa76eb7d93ed0b50aef4183e0ce77ee Author: Michael Tuexen AuthorDate: 2022-04-01 22:54:49 +0000 Commit: Michael Tuexen CommitDate: 2023-02-01 22:29:03 +0000 sctp: clear pointer to stack when returning from function. Reported by: syzbot+04cee5d8805dfbb63c06@syzkaller.appspotmail.com Reported by: syzbot+71e7e33dfc3cc39a6bd0@syzkaller.appspotmail.com Reported by: syzbot+6c36fc3c1bd03ed96107@syzkaller.appspotmail.com Reported by: syzbot+198b3751c158181c47de@syzkaller.appspotmail.com (cherry picked from commit 39a22011bbb820b389ce8ad166f7bdce112a75cc) --- sys/netinet/sctp_output.c | 38 ++++++++++++++++++-------------------- 1 file changed, 18 insertions(+), 20 deletions(-) diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c index 7e5c84228ecb..39a6140fd36c 100644 --- a/sys/netinet/sctp_output.c +++ b/sys/netinet/sctp_output.c @@ -12991,21 +12991,21 @@ sctp_lower_sosend(struct socket *so, SCTP_TCB_UNLOCK(stcb); hold_tcblock = false; error = sbwait(&so->so_snd); - if (error || so->so_error || be.error) { - if (error == 0) { - if (so->so_error != 0) { - error = so->so_error; - } - if (be.error != 0) { - error = be.error; - } + if (error == 0) { + if (so->so_error != 0) { + error = so->so_error; + } + if (be.error != 0) { + error = be.error; } - SOCKBUF_UNLOCK(&so->so_snd); - goto out_unlocked; } SOCKBUF_UNLOCK(&so->so_snd); SCTP_TCB_LOCK(stcb); hold_tcblock = true; + stcb->block_entry = NULL; + if (error != 0) { + goto out_unlocked; + } if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || (asoc->state & SCTP_STATE_WAS_ABORTED)) { if (asoc->state & SCTP_STATE_WAS_ABORTED) { @@ -13019,7 +13019,6 @@ sctp_lower_sosend(struct socket *so, } goto out_unlocked; } - stcb->block_entry = NULL; if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, asoc, asoc->total_output_queue_size); @@ -13352,14 +13351,14 @@ skip_preblock: SCTP_TCB_UNLOCK(stcb); hold_tcblock = false; error = sbwait(&so->so_snd); - if (error || so->so_error || be.error) { - if (error == 0) { - if (so->so_error) - error = so->so_error; - if (be.error) { - error = be.error; - } + if (error == 0) { + if (so->so_error != 0) + error = so->so_error; + if (be.error != 0) { + error = be.error; } + } + if (error != 0) { SOCKBUF_UNLOCK(&so->so_snd); SCTP_TCB_LOCK(stcb); hold_tcblock = true; @@ -13371,12 +13370,12 @@ skip_preblock: } goto out_unlocked; } - } SOCKBUF_UNLOCK(&so->so_snd); if (!hold_tcblock) { SCTP_TCB_LOCK(stcb); hold_tcblock = true; + stcb->block_entry = NULL; if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || (asoc->state & SCTP_STATE_WAS_ABORTED)) { if (asoc->state & SCTP_STATE_WAS_ABORTED) { @@ -13392,7 +13391,6 @@ skip_preblock: goto out; } } - stcb->block_entry = NULL; if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, asoc, asoc->total_output_queue_size);