From owner-svn-src-all@FreeBSD.ORG Thu Mar 15 14:13:39 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 24431106564A; Thu, 15 Mar 2012 14:13:39 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id E95CB8FC17; Thu, 15 Mar 2012 14:13:38 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q2FEDcON069287; Thu, 15 Mar 2012 14:13:38 GMT (envelope-from tuexen@svn.freebsd.org) Received: (from tuexen@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q2FEDcG3069284; Thu, 15 Mar 2012 14:13:38 GMT (envelope-from tuexen@svn.freebsd.org) Message-Id: <201203151413.q2FEDcG3069284@svn.freebsd.org> From: Michael Tuexen Date: Thu, 15 Mar 2012 14:13:38 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r233004 - in head/sys: kern netinet X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Mar 2012 14:13:39 -0000 Author: tuexen Date: Thu Mar 15 14:13:38 2012 New Revision: 233004 URL: http://svn.freebsd.org/changeset/base/233004 Log: Fix bugs which can result in a panic when an non-SCTP socket it used with an sctp_ system-call which expects an SCTP socket. MFC after: 3 days. Modified: head/sys/kern/uipc_syscalls.c head/sys/netinet/sctp_peeloff.c Modified: head/sys/kern/uipc_syscalls.c ============================================================================== --- head/sys/kern/uipc_syscalls.c Thu Mar 15 12:12:39 2012 (r233003) +++ head/sys/kern/uipc_syscalls.c Thu Mar 15 14:13:38 2012 (r233004) @@ -2321,6 +2321,10 @@ sys_sctp_peeloff(td, uap) error = fgetsock(td, uap->sd, CAP_PEELOFF, &head, &fflag); if (error) goto done2; + if (head->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto done2; + } error = sctp_can_peel_off(head, (sctp_assoc_t)uap->name); if (error) goto done2; @@ -2443,6 +2447,10 @@ sys_sctp_generic_sendmsg (td, uap) iov[0].iov_len = uap->mlen; so = (struct socket *)fp->f_data; + if (so->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto sctp_bad; + } #ifdef MAC error = mac_socket_check_send(td->td_ucred, so); if (error) @@ -2557,6 +2565,10 @@ sys_sctp_generic_sendmsg_iov(td, uap) #endif so = (struct socket *)fp->f_data; + if (so->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto sctp_bad; + } #ifdef MAC error = mac_socket_check_send(td->td_ucred, so); if (error) @@ -2662,6 +2674,10 @@ sys_sctp_generic_recvmsg(td, uap) goto out1; so = fp->f_data; + if (so->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto out; + } #ifdef MAC error = mac_socket_check_receive(td->td_ucred, so); if (error) { Modified: head/sys/netinet/sctp_peeloff.c ============================================================================== --- head/sys/netinet/sctp_peeloff.c Thu Mar 15 12:12:39 2012 (r233003) +++ head/sys/netinet/sctp_peeloff.c Thu Mar 15 14:13:38 2012 (r233004) @@ -59,16 +59,16 @@ sctp_can_peel_off(struct socket *head, s SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EBADF); return (EBADF); } - if ((head->so_proto->pr_protocol != IPPROTO_SCTP) || - (head->so_type != SOCK_SEQPACKET)) { - SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EOPNOTSUPP); - return (EOPNOTSUPP); - } inp = (struct sctp_inpcb *)head->so_pcb; if (inp == NULL) { SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EFAULT); return (EFAULT); } + if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || + (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { + SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EOPNOTSUPP); + return (EOPNOTSUPP); + } stcb = sctp_findassociation_ep_asocid(inp, assoc_id, 1); if (stcb == NULL) { SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_PEELOFF, ENOENT);