Date: Thu, 21 Jun 2018 17:24:11 +0000 (UTC) From: Matt Macy <mmacy@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r335497 - head/sys/netinet Message-ID: <201806211724.w5LHOBTp037811@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: mmacy Date: Thu Jun 21 17:24:10 2018 New Revision: 335497 URL: https://svnweb.freebsd.org/changeset/base/335497 Log: raw_ip: validate inp Post r335356 it is possible to have an inpcb on the hash lists that is partially torn down. Validate before using. Reported by: pho Modified: head/sys/netinet/raw_ip.c Modified: head/sys/netinet/raw_ip.c ============================================================================== --- head/sys/netinet/raw_ip.c Thu Jun 21 17:05:31 2018 (r335496) +++ head/sys/netinet/raw_ip.c Thu Jun 21 17:24:10 2018 (r335497) @@ -331,6 +331,10 @@ rip_input(struct mbuf **mp, int *offp, int proto) } INP_RLOCK(inp); last = inp; + if (__predict_false(inp->inp_flags2 & INP_FREED)) { + last = NULL; + INP_RUNLOCK(inp); + } } CK_LIST_FOREACH(inp, &V_ripcbinfo.ipi_hashbase[0], inp_hash) { if (inp->inp_ip_p && inp->inp_ip_p != proto)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201806211724.w5LHOBTp037811>