[src/trunk]: src/sys/netipsec Don't touch an SP without a reference to it

[ozaki-r <ozaki-r%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/6fe2d93590bd
branches:  trunk
changeset: 828180:6fe2d93590bd
user:      ozaki-r <ozaki-r%NetBSD.org@localhost>
date:      Fri Dec 01 06:34:14 2017 +0000

description:
Don't touch an SP without a reference to it

diffstat:

 sys/netipsec/key.c |  14 +++++++++++---
 1 files changed, 11 insertions(+), 3 deletions(-)

diffs (52 lines):

diff -r 016694ffc374 -r 6fe2d93590bd sys/netipsec/key.c
--- a/sys/netipsec/key.c        Fri Dec 01 01:08:35 2017 +0000
+++ b/sys/netipsec/key.c        Fri Dec 01 06:34:14 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: key.c,v 1.245 2017/11/30 02:45:12 ozaki-r Exp $        */
+/*     $NetBSD: key.c,v 1.246 2017/12/01 06:34:14 ozaki-r Exp $        */
 /*     $FreeBSD: src/sys/netipsec/key.c,v 1.3.2.3 2004/02/14 22:23:23 bms Exp $        */
 /*     $KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $   */
 
@@ -32,7 +32,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.245 2017/11/30 02:45:12 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.246 2017/12/01 06:34:14 ozaki-r Exp $");
 
 /*
  * This code is referred to RFC 2367
@@ -2112,6 +2112,7 @@
        struct secpolicyindex spidx;
        struct secpolicy *newsp;
        int error;
+       uint32_t sadb_x_policy_id;
 
        if (mhp->ext[SADB_EXT_ADDRESS_SRC] == NULL ||
            mhp->ext[SADB_EXT_ADDRESS_DST] == NULL ||
@@ -2216,9 +2217,16 @@
 
        key_init_sp(newsp);
 
+       sadb_x_policy_id = newsp->id;
+
        mutex_enter(&key_spd.lock);
        SPLIST_WRITER_INSERT_TAIL(newsp->spidx.dir, newsp);
        mutex_exit(&key_spd.lock);
+       /*
+        * We don't have a reference to newsp, so we must not touch newsp from
+        * now on.  If you want to do, you must take a reference beforehand.
+        */
+       newsp = NULL;
 
 #ifdef notyet
        /* delete the entry in key_misc.spacqlist */
@@ -2274,7 +2282,7 @@
                m_freem(n);
                return key_senderror(so, m, EINVAL);
        }
-       xpl->sadb_x_policy_id = newsp->id;
+       xpl->sadb_x_policy_id = sadb_x_policy_id;
 
        m_freem(m);
        return key_sendup_mbuf(so, n, KEY_SENDUP_ALL);