Differential D31973

socket: Fix a use-after-free in soclose()
ClosedPublic
Actions

Authored by markj on Sep 15 2021, 7:58 PM.

Details

Reviewers

None

Group Reviewers

network

Commits

rGdfcef8771484: socket: Fix a use-after-free in soclose()

Summary

After releasing a reference to a socket "so", we should avoid testing
SOLISTENING(so) since the socket may have been freed. Instead, directly
test whether the list of unaccepted sockets is empty.

Fixes: f4bb1869ddd2 ("Consistently use the SOLISTENING() macro")
Pointy hat: markj
MFC after: 3 days

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

markj created this revision.Sep 15 2021, 7:58 PM

Herald added a subscriber: imp. · View Herald TranscriptSep 15 2021, 7:58 PM

markj requested review of this revision.Sep 15 2021, 7:58 PM

Harbormaster completed remote builds in B41533: Diff 95226.Sep 15 2021, 7:58 PM

markj added a child revision: D31974: socket: Add assertions around naked refcount decrements.Sep 15 2021, 7:58 PM

markj added a reviewer: network.Sep 15 2021, 8:01 PM

This revision was not accepted when it landed; it landed in state Needs Review.Sep 17 2021, 7:13 PM

Closed by commit rGdfcef8771484: socket: Fix a use-after-free in soclose() (authored by markj). · Explain Why

This revision was automatically updated to reflect the committed changes.

markj added a commit: rGdfcef8771484: socket: Fix a use-after-free in soclose().

Revision Contents
Changeset List

Path

Size

sys/

kern/

uipc_socket.c

24 lines

Diff 95318

View Options

socket: Fix a use-after-free in soclose()ClosedPublicActions