hardenedbsd/HardenedBSD
1
0
Fork 0
mirror of https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git synced 2024-12-21 16:32:25 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

The UDP head was unlocked too early in one unicast case.

Browse Source 
Submitted by:	bug reported by arr
This commit is contained in:
Jeffrey Hsu 2002-06-12 15:21:41 +00:00
parent 0305323763
commit 61ffc0b1a6
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=98147
1 changed files with 10 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
sys/netinet/udp_usrreq.c
View File

@ -337,15 +337,13 @@ udp_input(m, off)
* for a broadcast or multicast datgram.)
*/
udpstat.udps_noportbcast++;
INP_INFO_RUNLOCK(&udbinfo);
goto bad;
goto badheadlocked;
}
#ifdef IPSEC
/* check AH/ESP integrity. */
if (ipsec4_in_reject_so(m, last->inp_socket)) {
ipsecstat.in_polvio++;
INP_INFO_RUNLOCK(&udbinfo);
goto bad;
goto badheadlocked;
}
#endif /*IPSEC*/
INP_UNLOCK(last);
@ -358,7 +356,6 @@ udp_input(m, off)
*/
inp = in_pcblookup_hash(&udbinfo, ip->ip_src, uh->uh_sport,
ip->ip_dst, uh->uh_dport, 1, m->m_pkthdr.rcvif);
INP_INFO_RUNLOCK(&udbinfo);
if (inp == NULL) {
if (log_in_vain) {
char buf[4*sizeof "123"];
@ -372,27 +369,27 @@ udp_input(m, off)
udpstat.udps_noport++;
if (m->m_flags & (M_BCAST | M_MCAST)) {
udpstat.udps_noportbcast++;
goto bad;
goto badheadlocked;
}
if (badport_bandlim(BANDLIM_ICMP_UNREACH) < 0)
goto bad;
goto badheadlocked;
if (blackhole)
goto bad;
goto badheadlocked;
*ip = save_ip;
ip->ip_len += iphlen;
icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
INP_INFO_RUNLOCK(&udbinfo);
return;
}
INP_LOCK(inp);
INP_INFO_RUNLOCK(&udbinfo);
#ifdef IPSEC
if (ipsec4_in_reject_so(m, inp->inp_socket)) {
ipsecstat.in_polvio++;
INP_INFO_RUNLOCK(&udbinfo);
goto bad;
}
#endif /*IPSEC*/
INP_LOCK(inp);
/*
* Construct sockaddr format source address.
* Stuff source address and datagram in user buffer.
@ -429,6 +426,9 @@ udp_input(m, off)
sorwakeup(inp->inp_socket);
INP_UNLOCK(inp);
return;
badheadlocked:
INP_INFO_RUNLOCK(&udbinfo);
bad:
if (inp)
INP_UNLOCK(inp);