From owner-svn-src-stable-8@FreeBSD.ORG Tue Mar 20 19:45:26 2012 Return-Path: Delivered-To: svn-src-stable-8@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 4593F106566C; Tue, 20 Mar 2012 19:45:26 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 27A198FC17; Tue, 20 Mar 2012 19:45:26 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q2KJjQBi035116; Tue, 20 Mar 2012 19:45:26 GMT (envelope-from tuexen@svn.freebsd.org) Received: (from tuexen@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q2KJjPi9035113; Tue, 20 Mar 2012 19:45:25 GMT (envelope-from tuexen@svn.freebsd.org) Message-Id: <201203201945.q2KJjPi9035113@svn.freebsd.org> From: Michael Tuexen Date: Tue, 20 Mar 2012 19:45:25 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-8@freebsd.org X-SVN-Group: stable-8 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r233247 - in stable/8/sys: i386/conf kern netinet X-BeenThere: svn-src-stable-8@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 8-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Mar 2012 19:45:26 -0000 Author: tuexen Date: Tue Mar 20 19:45:25 2012 New Revision: 233247 URL: http://svn.freebsd.org/changeset/base/233247 Log: MFC r233004: Fix bugs which can result in a panic when an non-SCTP socket it used with an sctp_ system-call which expects an SCTP socket. Modified: stable/8/sys/kern/uipc_syscalls.c stable/8/sys/netinet/sctp_peeloff.c Directory Properties: stable/8/sys/ (props changed) stable/8/sys/amd64/include/xen/ (props changed) stable/8/sys/boot/ (props changed) stable/8/sys/cddl/contrib/opensolaris/ (props changed) stable/8/sys/contrib/dev/acpica/ (props changed) stable/8/sys/contrib/pf/ (props changed) stable/8/sys/dev/e1000/ (props changed) stable/8/sys/i386/conf/XENHVM (props changed) Modified: stable/8/sys/kern/uipc_syscalls.c ============================================================================== --- stable/8/sys/kern/uipc_syscalls.c Tue Mar 20 19:42:40 2012 (r233246) +++ stable/8/sys/kern/uipc_syscalls.c Tue Mar 20 19:45:25 2012 (r233247) @@ -2300,6 +2300,10 @@ sctp_peeloff(td, uap) error = fgetsock(td, uap->sd, &head, &fflag); if (error) goto done2; + if (head->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto done2; + } error = sctp_can_peel_off(head, (sctp_assoc_t)uap->name); if (error) goto done2; @@ -2418,6 +2422,10 @@ sctp_generic_sendmsg (td, uap) iov[0].iov_len = uap->mlen; so = (struct socket *)fp->f_data; + if (so->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto sctp_bad; + } #ifdef MAC error = mac_socket_check_send(td->td_ucred, so); if (error) @@ -2528,6 +2536,10 @@ sctp_generic_sendmsg_iov(td, uap) #endif so = (struct socket *)fp->f_data; + if (so->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto sctp_bad; + } #ifdef MAC error = mac_socket_check_send(td->td_ucred, so); if (error) @@ -2632,6 +2644,10 @@ sctp_generic_recvmsg(td, uap) goto out1; so = fp->f_data; + if (so->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto out; + } #ifdef MAC error = mac_socket_check_receive(td->td_ucred, so); if (error) { Modified: stable/8/sys/netinet/sctp_peeloff.c ============================================================================== --- stable/8/sys/netinet/sctp_peeloff.c Tue Mar 20 19:42:40 2012 (r233246) +++ stable/8/sys/netinet/sctp_peeloff.c Tue Mar 20 19:45:25 2012 (r233247) @@ -59,16 +59,16 @@ sctp_can_peel_off(struct socket *head, s SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EBADF); return (EBADF); } - if ((head->so_proto->pr_protocol != IPPROTO_SCTP) || - (head->so_type != SOCK_SEQPACKET)) { - SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EOPNOTSUPP); - return (EOPNOTSUPP); - } inp = (struct sctp_inpcb *)head->so_pcb; if (inp == NULL) { SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EFAULT); return (EFAULT); } + if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || + (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { + SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EOPNOTSUPP); + return (EOPNOTSUPP); + } stcb = sctp_findassociation_ep_asocid(inp, assoc_id, 1); if (stcb == NULL) { SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_PEELOFF, ENOENT);