Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 4 May 2019 11:07:36 +0000 (UTC)
From:      Michael Tuexen <tuexen@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org
Subject:   svn commit: r347103 - stable/12/sys/netinet
Message-ID:  <201905041107.x44B7aQT030106@repo.freebsd.org>

next in thread | raw e-mail | index | archive | help
Author: tuexen
Date: Sat May  4 11:07:35 2019
New Revision: 347103
URL: https://svnweb.freebsd.org/changeset/base/347103

Log:
  MFC r344724:
  Allow SCTP stream reconfiguration operations only in ESTABLISHED
  state.
  
  This issue was found by running syzkaller.

Modified:
  stable/12/sys/netinet/sctp_usrreq.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_usrreq.c
==============================================================================
--- stable/12/sys/netinet/sctp_usrreq.c	Sat May  4 11:05:57 2019	(r347102)
+++ stable/12/sys/netinet/sctp_usrreq.c	Sat May  4 11:07:35 2019	(r347103)
@@ -4631,6 +4631,12 @@ sctp_setopt(struct socket *so, int optname, void *optv
 				SCTP_TCB_UNLOCK(stcb);
 				break;
 			}
+			if (SCTP_GET_STATE(stcb) != SCTP_STATE_OPEN) {
+				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL);
+				error = EINVAL;
+				SCTP_TCB_UNLOCK(stcb);
+				break;
+			}
 			if (sizeof(struct sctp_reset_streams) +
 			    strrst->srs_number_streams * sizeof(uint16_t) > optsize) {
 				error = EINVAL;
@@ -4745,6 +4751,12 @@ sctp_setopt(struct socket *so, int optname, void *optv
 				SCTP_TCB_UNLOCK(stcb);
 				break;
 			}
+			if (SCTP_GET_STATE(stcb) != SCTP_STATE_OPEN) {
+				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL);
+				error = EINVAL;
+				SCTP_TCB_UNLOCK(stcb);
+				break;
+			}
 			if (stcb->asoc.stream_reset_outstanding) {
 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EALREADY);
 				error = EALREADY;
@@ -4812,6 +4824,12 @@ sctp_setopt(struct socket *so, int optname, void *optv
 				 */
 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EOPNOTSUPP);
 				error = EOPNOTSUPP;
+				SCTP_TCB_UNLOCK(stcb);
+				break;
+			}
+			if (SCTP_GET_STATE(stcb) != SCTP_STATE_OPEN) {
+				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_USRREQ, EINVAL);
+				error = EINVAL;
 				SCTP_TCB_UNLOCK(stcb);
 				break;
 			}



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201905041107.x44B7aQT030106>