svn commit: r352438 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Tue Sep 17 09:46:42 2019
New Revision: 352438
URL: https://svnweb.freebsd.org/changeset/base/352438

Log:
  Only allow a SCTP-AUTH shared key to be updated by the application
  if it is not deactivated and not used.
  This avoids a use-after-free problem.
  
  Reported by:		da_cheng_shao at yeah.net
  MFC after:		3 days

Modified:
  head/sys/netinet/sctp_auth.c

Modified: head/sys/netinet/sctp_auth.c
==============================================================================
--- head/sys/netinet/sctp_auth.c	Tue Sep 17 08:09:39 2019	(r352437)
+++ head/sys/netinet/sctp_auth.c	Tue Sep 17 09:46:42 2019	(r352438)
@@ -523,7 +523,7 @@ sctp_insert_sharedkey(struct sctp_keyhead *shared_keys
 		} else if (new_skey->keyid == skey->keyid) {
 			/* replace the existing key */
 			/* verify this key *can* be replaced */
-			if ((skey->deactivated) && (skey->refcount > 1)) {
+			if ((skey->deactivated) || (skey->refcount > 1)) {
 				SCTPDBG(SCTP_DEBUG_AUTH1,
 				    "can't replace shared key id %u\n",
 				    new_skey->keyid);