svn commit: r364643 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Mon Aug 24 09:15:52 2020
New Revision: 364643
URL: https://svnweb.freebsd.org/changeset/base/364643

Log:
  MFC r363456:
  Clear the pointer to the socket when closing it also in case of
  an ungraceful operation.
  This fixes a use-after-free bug found and reported by Taylor
  Brandstetter of Google by testing the userland stack.

Modified:
  stable/12/sys/netinet/sctp_pcb.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_pcb.c
==============================================================================
--- stable/12/sys/netinet/sctp_pcb.c	Mon Aug 24 09:14:32 2020	(r364642)
+++ stable/12/sys/netinet/sctp_pcb.c	Mon Aug 24 09:15:52 2020	(r364643)
@@ -3545,6 +3545,11 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate,
 	cnt = 0;
 	LIST_FOREACH_SAFE(asoc, &inp->sctp_asoc_list, sctp_tcblist, nasoc) {
 		SCTP_TCB_LOCK(asoc);
+		if (immediate != SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
+			/* Disconnect the socket please */
+			asoc->sctp_socket = NULL;
+			SCTP_ADD_SUBSTATE(asoc, SCTP_STATE_CLOSED_SOCKET);
+		}
 		if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
 			if (asoc->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
 				SCTP_CLEAR_SUBSTATE(asoc, SCTP_STATE_IN_ACCEPT_QUEUE);