From edef5a62addae78306e9f084f0c92a2e73e253c8 Mon Sep 17 00:00:00 2001
From: rwatson <rwatson@FreeBSD.org>
Date: Sun, 26 Mar 2006 19:37:37 +0000
Subject: In various SPX protocol entry points from the socket layer, check
 IPXP_DROPPED before continuing, and return EINVAL or ECONNRESET if it is
 flagged.  It's unclear why each situation should be one or the other, but it
 is copied from netinet which has the same bugs.

MFC after:	1 month
---
 sys/netipx/spx_usrreq.c | 60 +++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 53 insertions(+), 7 deletions(-)

(limited to 'sys/netipx')

diff --git a/sys/netipx/spx_usrreq.c b/sys/netipx/spx_usrreq.c
index 4b1da04..06c258e 100644
--- a/sys/netipx/spx_usrreq.c
+++ b/sys/netipx/spx_usrreq.c
@@ -1451,7 +1451,12 @@ spx_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 
 	IPX_LIST_LOCK();
 	IPX_LOCK(ipxp);
+	if (ipxp->ipxp_flags & IPXP_DROPPED) {
+		error = EINVAL;
+		goto out;
+	}
 	error = ipx_pcbbind(ipxp, nam, td);
+out:
 	IPX_UNLOCK(ipxp);
 	IPX_LIST_UNLOCK();
 	return (error);
@@ -1477,6 +1482,10 @@ spx_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 
 	IPX_LIST_LOCK();
 	IPX_LOCK(ipxp);
+	if (ipxp->ipxp_flags & IPXP_DROPPED) {
+		error = EINVAL;
+		goto spx_connect_end;
+	}
 	if (ipxp->ipxp_lport == 0) {
 		error = ipx_pcbbind(ipxp, NULL, td);
 		if (error)
@@ -1540,6 +1549,7 @@ spx_usr_disconnect(struct socket *so)
 {
 	struct ipxpcb *ipxp;
 	struct spxpcb *cb;
+	int error;
 
 	ipxp = sotoipxpcb(so);
 	KASSERT(ipxp != NULL, ("spx_usr_disconnect: ipxp == NULL"));
@@ -1549,10 +1559,16 @@ spx_usr_disconnect(struct socket *so)
 
 	IPX_LIST_LOCK();
 	IPX_LOCK(ipxp);
+	if (ipxp->ipxp_flags & IPXP_DROPPED) {
+		error = EINVAL;
+		goto out;
+	}
 	spx_disconnect(cb);
+	error = 0;
+out:
 	IPX_UNLOCK(ipxp);
 	IPX_LIST_UNLOCK();
-	return (0);
+	return (error);
 }
 
 static int
@@ -1571,6 +1587,10 @@ spx_listen(struct socket *so, int backlog, struct thread *td)
 
 	IPX_LIST_LOCK();
 	IPX_LOCK(ipxp);
+	if (ipxp->ipxp_flags & IPXP_DROPPED) {
+		error = EINVAL;
+		goto out;
+	}
 	SOCK_LOCK(so);
 	error = solisten_proto_check(so);
 	if (error == 0 && ipxp->ipxp_lport == 0)
@@ -1580,6 +1600,7 @@ spx_listen(struct socket *so, int backlog, struct thread *td)
 		solisten_proto(so, backlog);
 	}
 	SOCK_UNLOCK(so);
+out:
 	IPX_UNLOCK(ipxp);
 	IPX_LIST_UNLOCK();
 	return (error);
@@ -1593,6 +1614,7 @@ spx_rcvd(struct socket *so, int flags)
 {
 	struct ipxpcb *ipxp;
 	struct spxpcb *cb;
+	int error;
 
 	ipxp = sotoipxpcb(so);
 	KASSERT(ipxp != NULL, ("spx_rcvd: ipxp == NULL"));
@@ -1601,11 +1623,17 @@ spx_rcvd(struct socket *so, int flags)
 	KASSERT(cb != NULL, ("spx_rcvd: cb == NULL"));
 
 	IPX_LOCK(ipxp);
+	if (ipxp->ipxp_flags & IPXP_DROPPED) {
+		error = EINVAL;
+		goto out;
+	}
 	cb->s_flags |= SF_RVD;
 	spx_output(cb, NULL);
 	cb->s_flags &= ~SF_RVD;
+	error = 0;
+out:
 	IPX_UNLOCK(ipxp);
-	return (0);
+	return (error);
 }
 
 static int
@@ -1613,6 +1641,7 @@ spx_rcvoob(struct socket *so, struct mbuf *m, int flags)
 {
 	struct ipxpcb *ipxp;
 	struct spxpcb *cb;
+	int error;
 
 	ipxp = sotoipxpcb(so);
 	KASSERT(ipxp != NULL, ("spx_rcvoob: ipxp == NULL"));
@@ -1621,27 +1650,33 @@ spx_rcvoob(struct socket *so, struct mbuf *m, int flags)
 	KASSERT(cb != NULL, ("spx_rcvoob: cb == NULL"));
 
 	IPX_LOCK(ipxp);
+	if (ipxp->ipxp_flags & IPXP_DROPPED) {
+		error = EINVAL;
+		goto out;
+	}
 	SOCKBUF_LOCK(&so->so_rcv);
 	if ((cb->s_oobflags & SF_IOOB) || so->so_oobmark ||
 	    (so->so_rcv.sb_state & SBS_RCVATMARK)) {
 		SOCKBUF_UNLOCK(&so->so_rcv);
 		m->m_len = 1;
 		*mtod(m, caddr_t) = cb->s_iobc;
-		IPX_UNLOCK(ipxp);
-		return (0);
+		error = 0;
+		goto out;
 	}
 	SOCKBUF_UNLOCK(&so->so_rcv);
+	error = EINVAL;
+out:
 	IPX_UNLOCK(ipxp);
-	return (EINVAL);
+	return (error);
 }
 
 static int
 spx_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
     struct mbuf *controlp, struct thread *td)
 {
-	int error;
 	struct ipxpcb *ipxp;
 	struct spxpcb *cb;
+	int error;
 
 	ipxp = sotoipxpcb(so);
 	KASSERT(ipxp != NULL, ("spx_send: ipxp == NULL"));
@@ -1651,6 +1686,10 @@ spx_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
 
 	error = 0;
 	IPX_LOCK(ipxp);
+	if (ipxp->ipxp_flags & IPXP_DROPPED) {
+		error = ECONNRESET;
+		goto spx_send_end;
+	}
 	if (flags & PRUS_OOB) {
 		if (sbspace(&so->so_snd) < -512) {
 			error = ENOBUFS;
@@ -1684,6 +1723,7 @@ spx_shutdown(struct socket *so)
 {
 	struct ipxpcb *ipxp;
 	struct spxpcb *cb;
+	int error;
 
 	ipxp = sotoipxpcb(so);
 	KASSERT(ipxp != NULL, ("spx_shutdown: ipxp == NULL"));
@@ -1694,10 +1734,16 @@ spx_shutdown(struct socket *so)
 	socantsendmore(so);
 	IPX_LIST_LOCK();
 	IPX_LOCK(ipxp);
+	if (ipxp->ipxp_flags & IPXP_DROPPED) {
+		error = EINVAL;
+		goto out;
+	}
 	spx_usrclosed(cb);
+	error = 0;
+out:
 	IPX_UNLOCK(ipxp);
 	IPX_LIST_UNLOCK();
-	return (0);
+	return (error);
 }
 
 static int
-- 
cgit v1.1