From owner-svn-src-all@FreeBSD.ORG Wed Mar 21 08:08:24 2012 Return-Path: Delivered-To: svn-src-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 88EBA1065673; Wed, 21 Mar 2012 08:08:24 +0000 (UTC) (envelope-from tuexen@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 6C1C38FC18; Wed, 21 Mar 2012 08:08:24 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id q2L88ODC061229; Wed, 21 Mar 2012 08:08:24 GMT (envelope-from tuexen@svn.freebsd.org) Received: (from tuexen@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id q2L88ORw061226; Wed, 21 Mar 2012 08:08:24 GMT (envelope-from tuexen@svn.freebsd.org) Message-Id: <201203210808.q2L88ORw061226@svn.freebsd.org> From: Michael Tuexen Date: Wed, 21 Mar 2012 08:08:24 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org X-SVN-Group: releng MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r233270 - in releng/8.3/sys: i386/conf kern netinet X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Mar 2012 08:08:24 -0000 Author: tuexen Date: Wed Mar 21 08:08:23 2012 New Revision: 233270 URL: http://svn.freebsd.org/changeset/base/233270 Log: MFC r233004: Fix bugs which can result in a panic when an non-SCTP socket it used with an sctp_ system-call which expects an SCTP socket. Approved by: re@ Modified: releng/8.3/sys/kern/uipc_syscalls.c releng/8.3/sys/netinet/sctp_peeloff.c Directory Properties: releng/8.3/sys/ (props changed) releng/8.3/sys/amd64/include/xen/ (props changed) releng/8.3/sys/boot/ (props changed) releng/8.3/sys/cddl/contrib/opensolaris/ (props changed) releng/8.3/sys/contrib/dev/acpica/ (props changed) releng/8.3/sys/contrib/pf/ (props changed) releng/8.3/sys/dev/e1000/ (props changed) releng/8.3/sys/i386/conf/XENHVM (props changed) Modified: releng/8.3/sys/kern/uipc_syscalls.c ============================================================================== --- releng/8.3/sys/kern/uipc_syscalls.c Wed Mar 21 08:03:07 2012 (r233269) +++ releng/8.3/sys/kern/uipc_syscalls.c Wed Mar 21 08:08:23 2012 (r233270) @@ -2300,6 +2300,10 @@ sctp_peeloff(td, uap) error = fgetsock(td, uap->sd, &head, &fflag); if (error) goto done2; + if (head->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto done2; + } error = sctp_can_peel_off(head, (sctp_assoc_t)uap->name); if (error) goto done2; @@ -2418,6 +2422,10 @@ sctp_generic_sendmsg (td, uap) iov[0].iov_len = uap->mlen; so = (struct socket *)fp->f_data; + if (so->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto sctp_bad; + } #ifdef MAC error = mac_socket_check_send(td->td_ucred, so); if (error) @@ -2528,6 +2536,10 @@ sctp_generic_sendmsg_iov(td, uap) #endif so = (struct socket *)fp->f_data; + if (so->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto sctp_bad; + } #ifdef MAC error = mac_socket_check_send(td->td_ucred, so); if (error) @@ -2632,6 +2644,10 @@ sctp_generic_recvmsg(td, uap) goto out1; so = fp->f_data; + if (so->so_proto->pr_protocol != IPPROTO_SCTP) { + error = EOPNOTSUPP; + goto out; + } #ifdef MAC error = mac_socket_check_receive(td->td_ucred, so); if (error) { Modified: releng/8.3/sys/netinet/sctp_peeloff.c ============================================================================== --- releng/8.3/sys/netinet/sctp_peeloff.c Wed Mar 21 08:03:07 2012 (r233269) +++ releng/8.3/sys/netinet/sctp_peeloff.c Wed Mar 21 08:08:23 2012 (r233270) @@ -59,16 +59,16 @@ sctp_can_peel_off(struct socket *head, s SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EBADF); return (EBADF); } - if ((head->so_proto->pr_protocol != IPPROTO_SCTP) || - (head->so_type != SOCK_SEQPACKET)) { - SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EOPNOTSUPP); - return (EOPNOTSUPP); - } inp = (struct sctp_inpcb *)head->so_pcb; if (inp == NULL) { SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EFAULT); return (EFAULT); } + if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) || + (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) { + SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PEELOFF, EOPNOTSUPP); + return (EOPNOTSUPP); + } stcb = sctp_findassociation_ep_asocid(inp, assoc_id, 1); if (stcb == NULL) { SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_PEELOFF, ENOENT);