Fix a potential use-after-free bug introduced in
Thanks to Taylor Brandstetter for finding this issue using fuzz testing
and reporting it in
#if defined(__FreeBSD__) && !defined(__Userspace__)
#include <sys/cdefs.h>
-__FBSDID("$FreeBSD: head/sys/netinet/sctp_indata.c 366426 2020-10-04 15:37:34Z tuexen $");
+__FBSDID("$FreeBSD: head/sys/netinet/sctp_indata.c 367520 2020-11-09 13:12:07Z tuexen $");
#endif
#include <netinet/sctp_os.h>
@@ -5566,7 +5566,7 @@ sctp_handle_forward_tsn(struct sctp_tcb *stcb,
unsigned int i, fwd_sz, m_size;
uint32_t str_seq;
struct sctp_stream_in *strm;
- struct sctp_queued_to_read *control, *sv;
+ struct sctp_queued_to_read *control, *ncontrol, *sv;
asoc = &stcb->asoc;
if ((fwd_sz = ntohs(fwd->ch.chunk_length)) < sizeof(struct sctp_forward_tsn_chunk)) {
@@ -5723,14 +5723,14 @@ sctp_handle_forward_tsn(struct sctp_tcb *stcb,
}
strm = &asoc->strmin[sid];
if (ordered) {
- TAILQ_FOREACH(control, &strm->inqueue, next_instrm) {
+ TAILQ_FOREACH_SAFE(control, &strm->inqueue, next_instrm, ncontrol) {
if (SCTP_MID_GE(asoc->idata_supported, mid, control->mid)) {
sctp_flush_reassm_for_str_seq(stcb, asoc, strm, control, ordered, new_cum_tsn);
}
}
} else {
if (asoc->idata_supported) {
- TAILQ_FOREACH(control, &strm->uno_inqueue, next_instrm) {
+ TAILQ_FOREACH_SAFE(control, &strm->uno_inqueue, next_instrm, ncontrol) {
if (SCTP_MID_GE(asoc->idata_supported, mid, control->mid)) {
sctp_flush_reassm_for_str_seq(stcb, asoc, strm, control, ordered, new_cum_tsn);
}
