From nobody Fri Apr 1 22:55:25 2022 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 9032F1A548D3; Fri, 1 Apr 2022 22:55:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4KVb9V0Z1rz4lHT; Fri, 1 Apr 2022 22:55:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1648853726; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9s8FVAuc/qA3Uxqyz5ET/Eccoi+rSQI8d11eQf9hU3A=; b=TKCR6E8In0gesB4vfQY6GnV3k98ep0Vt+byzwl2m9r3+A62AEc2Nx87RJk3ot8959BOC2A 6XXVWnQUxRu6qoo+Hq+OsGgkujovt/ZiD0MpZb35vMfSoUvHCc5zdHncASWFHe2xHyFajn W+BFlM6qm4kpJZcTjgpho4VVLPA9s4VsW4XvdXGsFFMkjEi8Bn3sDzBQOqUMfex7L/gNsB 3/kMYClra+YzEmrIwqLwOIL7xi+oFqVyZjZ5MOhXqWmj5tlWJRe1/JU4BqT/BdlX+7yn9M F0wG6nEwMBQ7FHQLPy2gMCCPf5J79fPjF585L7GOZqUuQFj7jJZ1AOYmYDm+1Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 81A6D1D1F2; Fri, 1 Apr 2022 22:55:25 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 231MtPC3097907; Fri, 1 Apr 2022 22:55:25 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 231MtPpT097906; Fri, 1 Apr 2022 22:55:25 GMT (envelope-from git) Date: Fri, 1 Apr 2022 22:55:25 GMT Message-Id: <202204012255.231MtPpT097906@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Michael Tuexen Subject: git: 39a22011bbb8 - main - sctp: clear pointer to stack when returning from function. List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-main@freebsd.org X-BeenThere: dev-commits-src-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 39a22011bbb820b389ce8ad166f7bdce112a75cc Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1648853726; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=9s8FVAuc/qA3Uxqyz5ET/Eccoi+rSQI8d11eQf9hU3A=; b=sEBrgDp9jbyAg8fMOSGAC7tp7MZiPLyjI49cyBo+Ky1vzkrNCRbeNJyav7RHPGS5PJx9Hs pde6tK/lnuqTnSShhgglSB/OIWw8SwkW0Sb2oub6rZjfD2xMsPtUjOLQhEKTmn/YYKNN1g utay6j2i5XW6qnjYV6ueHHlOHdgbvii4U8uwAvYu67DMxnl3RQeNTqhywvv1WZ10rFjGf/ W+X4zBBLuTe+3Dc4f4oc04yUAahPzU71l2rNT8vWWSEbUgaMFHZAmHO6awrI3aP5EW7ytC h0QMWaLzvw5/F2fm+3cNCIkzhvMrYWHJ38D4Ym16tJMy0omJ9gIsupO1KdkjmA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1648853726; a=rsa-sha256; cv=none; b=ecdROUE//7dpRJc3WaIkaRToSY4yUJF5cZKIi301HnCFKgxTQu2lljUgANtEWB+Jqz8Znu 25yVfcpmMexLdcTb0sUWYiPjL3DJw4DZCHE+sfcHY2o4xfHd8yX9gi2ZcwI84ZVcoIgOLe 1+W16JveTyhoI67C60fdFs5JUx2I+xZ3kl6Hqxz5jKwviAnG5Wc6AIBt+ZDwNCYbmDQjEg IonxxNfI915Lqz5xVdMfN0Bepo0l+6iedhWXmIAErFSFwnHkUXI1mpcqax8h3j1Kt0pttW jqUy8ySgNpYznpBIf7jjS2jwIk/xNxsV/XwI+h4H60mKSHEaBN502paMIj5IqA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=39a22011bbb820b389ce8ad166f7bdce112a75cc commit 39a22011bbb820b389ce8ad166f7bdce112a75cc Author: Michael Tuexen AuthorDate: 2022-04-01 22:54:49 +0000 Commit: Michael Tuexen CommitDate: 2022-04-01 22:54:49 +0000 sctp: clear pointer to stack when returning from function. Reported by: syzbot+04cee5d8805dfbb63c06@syzkaller.appspotmail.com Reported by: syzbot+71e7e33dfc3cc39a6bd0@syzkaller.appspotmail.com Reported by: syzbot+6c36fc3c1bd03ed96107@syzkaller.appspotmail.com Reported by: syzbot+198b3751c158181c47de@syzkaller.appspotmail.com --- sys/netinet/sctp_output.c | 38 ++++++++++++++++++-------------------- 1 file changed, 18 insertions(+), 20 deletions(-) diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c index 7aa6c433b684..5f205b1c3af4 100644 --- a/sys/netinet/sctp_output.c +++ b/sys/netinet/sctp_output.c @@ -12993,21 +12993,21 @@ sctp_lower_sosend(struct socket *so, SCTP_TCB_UNLOCK(stcb); hold_tcblock = false; error = sbwait(&so->so_snd); - if (error || so->so_error || be.error) { - if (error == 0) { - if (so->so_error != 0) { - error = so->so_error; - } - if (be.error != 0) { - error = be.error; - } + if (error == 0) { + if (so->so_error != 0) { + error = so->so_error; + } + if (be.error != 0) { + error = be.error; } - SOCKBUF_UNLOCK(&so->so_snd); - goto out_unlocked; } SOCKBUF_UNLOCK(&so->so_snd); SCTP_TCB_LOCK(stcb); hold_tcblock = true; + stcb->block_entry = NULL; + if (error != 0) { + goto out_unlocked; + } if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || (asoc->state & SCTP_STATE_WAS_ABORTED)) { if (asoc->state & SCTP_STATE_WAS_ABORTED) { @@ -13021,7 +13021,6 @@ sctp_lower_sosend(struct socket *so, } goto out_unlocked; } - stcb->block_entry = NULL; if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, asoc, asoc->total_output_queue_size); @@ -13354,14 +13353,14 @@ skip_preblock: SCTP_TCB_UNLOCK(stcb); hold_tcblock = false; error = sbwait(&so->so_snd); - if (error || so->so_error || be.error) { - if (error == 0) { - if (so->so_error) - error = so->so_error; - if (be.error) { - error = be.error; - } + if (error == 0) { + if (so->so_error != 0) + error = so->so_error; + if (be.error != 0) { + error = be.error; } + } + if (error != 0) { SOCKBUF_UNLOCK(&so->so_snd); SCTP_TCB_LOCK(stcb); hold_tcblock = true; @@ -13373,12 +13372,12 @@ skip_preblock: } goto out_unlocked; } - } SOCKBUF_UNLOCK(&so->so_snd); if (!hold_tcblock) { SCTP_TCB_LOCK(stcb); hold_tcblock = true; + stcb->block_entry = NULL; if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) || (asoc->state & SCTP_STATE_WAS_ABORTED)) { if (asoc->state & SCTP_STATE_WAS_ABORTED) { @@ -13394,7 +13393,6 @@ skip_preblock: goto out; } } - stcb->block_entry = NULL; if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) { sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK, asoc, asoc->total_output_queue_size);