svn commit: r280642 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Wed Mar 25 22:45:54 2015
New Revision: 280642
URL: https://svnweb.freebsd.org/changeset/base/280642

Log:
  Make sure that we don't free an SCTP shared key too early.
  Thanks to Pouyan Sepehrdad from Qualcomm Product Security Initiative
  for reporting the issue.
  MFC after: 3 days

Modified:
  head/sys/netinet/sctp_auth.c

Modified: head/sys/netinet/sctp_auth.c
==============================================================================
--- head/sys/netinet/sctp_auth.c	Wed Mar 25 22:35:08 2015	(r280641)
+++ head/sys/netinet/sctp_auth.c	Wed Mar 25 22:45:54 2015	(r280642)
@@ -576,13 +576,12 @@ sctp_auth_key_release(struct sctp_tcb *s
 
 	/* decrement the ref count */
 	if (skey) {
-		sctp_free_sharedkey(skey);
 		SCTPDBG(SCTP_DEBUG_AUTH2,
 		    "%s: stcb %p key %u refcount release to %d\n",
 		    __FUNCTION__, (void *)stcb, key_id, skey->refcount);
 
 		/* see if a notification should be generated */
-		if ((skey->refcount <= 1) && (skey->deactivated)) {
+		if ((skey->refcount <= 2) && (skey->deactivated)) {
 			/* notify ULP that key is no longer used */
 			sctp_ulp_notify(SCTP_NOTIFY_AUTH_FREE_KEY, stcb,
 			    key_id, 0, so_locked);
@@ -590,6 +589,7 @@ sctp_auth_key_release(struct sctp_tcb *s
 			    "%s: stcb %p key %u no longer used, %d\n",
 			    __FUNCTION__, (void *)stcb, key_id, skey->refcount);
 		}
+		sctp_free_sharedkey(skey);
 	}
 }