diff options
| author | Martin Pieuchot <mpi@cvs.openbsd.org> | 2020-04-04 16:41:24 +0000 |
|---|---|---|
| committer | Martin Pieuchot <mpi@cvs.openbsd.org> | 2020-04-04 16:41:24 +0000 |
| commit | 3a36076649f1857a1251df384f9861285ae3ba4c (patch) | |
| tree | 2298e766c01361f23f57de7d4cdd66a474468bbb /sys | |
| parent | b59f08b5a2f135e4ab2c093af2ee2631157e598b (diff) | |
Prevent the destruction of a session owned by another interface.
Issue reported by and fix from Vitaliy Makkoveev.
Diffstat (limited to 'sys')
| -rw-r--r-- | sys/net/pipex.c | 9 | ||||
| -rw-r--r-- | sys/net/pipex_local.h | 5 |
2 files changed, 9 insertions, 5 deletions
diff --git a/sys/net/pipex.c b/sys/net/pipex.c index 3da8ed8b774..9914b9294a4 100644 --- a/sys/net/pipex.c +++ b/sys/net/pipex.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pipex.c,v 1.109 2020/03/26 16:50:46 mpi Exp $ */ +/* $OpenBSD: pipex.c,v 1.110 2020/04/04 16:41:23 mpi Exp $ */ /*- * Copyright (c) 2009 Internet Initiative Japan Inc. @@ -230,7 +230,7 @@ pipex_ioctl(struct pipex_iface_context *pipex_iface, u_long cmd, caddr_t data) case PIPEXDSESSION: ret = pipex_close_session( - (struct pipex_session_close_req *)data); + (struct pipex_session_close_req *)data, pipex_iface); break; case PIPEXCSESSION: @@ -489,7 +489,8 @@ pipex_notify_close_session_all(void) } Static int -pipex_close_session(struct pipex_session_close_req *req) +pipex_close_session(struct pipex_session_close_req *req, + struct pipex_iface_context *iface) { struct pipex_session *session; @@ -498,6 +499,8 @@ pipex_close_session(struct pipex_session_close_req *req) req->pcr_session_id); if (session == NULL) return (EINVAL); + if (session->pipex_iface != iface) + return (EINVAL); /* remove from close_wait list */ if (session->state == PIPEX_STATE_CLOSE_WAIT) diff --git a/sys/net/pipex_local.h b/sys/net/pipex_local.h index cf02c8e284d..57997154d59 100644 --- a/sys/net/pipex_local.h +++ b/sys/net/pipex_local.h @@ -1,4 +1,4 @@ -/* $OpenBSD: pipex_local.h,v 1.31 2020/02/15 07:16:03 yasuoka Exp $ */ +/* $OpenBSD: pipex_local.h,v 1.32 2020/04/04 16:41:23 mpi Exp $ */ /* * Copyright (c) 2009 Internet Initiative Japan Inc. @@ -369,7 +369,8 @@ extern struct pipex_hash_head pipex_id_hashtable[]; void pipex_iface_start (struct pipex_iface_context *); void pipex_iface_stop (struct pipex_iface_context *); int pipex_add_session (struct pipex_session_req *, struct pipex_iface_context *); -int pipex_close_session (struct pipex_session_close_req *); +int pipex_close_session (struct pipex_session_close_req *, + struct pipex_iface_context *); int pipex_config_session (struct pipex_session_config_req *); int pipex_get_stat (struct pipex_session_stat_req *); int pipex_get_closed (struct pipex_session_list_req *); |