Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 16 May 2019 09:32:01 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org
Subject:   svn commit: r347680 - stable/11/sys/netinet
Message-ID:  <201905160932.x4G9W1ju048052@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: tuexen
Date: Thu May 16 09:32:00 2019
New Revision: 347680
URL: https://svnweb.freebsd.org/changeset/base/347680

Log:
  MFC r345525:
  
  Fix a double free of an SCTP association in an error path.
  This is joint work with rrs@. The issue was found by running
  syzkaller.

Modified:
  stable/11/sys/netinet/sctp_usrreq.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet/sctp_usrreq.c
==============================================================================
--- stable/11/sys/netinet/sctp_usrreq.c	Thu May 16 09:29:49 2019	(r347679)
+++ stable/11/sys/netinet/sctp_usrreq.c	Thu May 16 09:32:00 2019	(r347680)
@@ -1481,8 +1481,6 @@ sctp_do_connect_x(struct socket *so, struct sctp_inpcb
 	sctp_connectx_helper_add(stcb, sa, (totaddr - 1), &error);
 	/* Fill in the return id */
 	if (error) {
-		(void)sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE,
-		    SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
 		goto out_now;
 	}
 	a_id = (sctp_assoc_t *)optval;



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201905160932.x4G9W1ju048052>