diff options
| author | Michael Tuexen <tuexen@fh-muenster.de> | 2020-04-11 22:41:28 +0200 |
|---|---|---|
| committer | Michael Tuexen <tuexen@fh-muenster.de> | 2020-04-11 22:41:28 +0200 |
| commit | 6ce0f8fe7455e566a6833684ec5983547658856d (patch) | |
| tree | 7b0a7592c906aa698c015661e552d6fb09f449d1 | |
| parent | 66a25d7fbf997da958b2c2980361b79fe2b459cb (diff) | |
| download | usrsctp-6ce0f8fe7455e566a6833684ec5983547658856d.tar.gz | |
Zero out pointers for consistency.
This was found by running a syzkaller instance on a INVARIANTS kernel.
| -rwxr-xr-x | usrsctplib/netinet/sctp_output.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/usrsctplib/netinet/sctp_output.c b/usrsctplib/netinet/sctp_output.c index 6b8566fd..3494185c 100755 --- a/usrsctplib/netinet/sctp_output.c +++ b/usrsctplib/netinet/sctp_output.c @@ -34,7 +34,7 @@ #ifdef __FreeBSD__ #include <sys/cdefs.h> -__FBSDID("$FreeBSD: head/sys/netinet/sctp_output.c 359156 2020-03-19 23:07:52Z tuexen $"); +__FBSDID("$FreeBSD: head/sys/netinet/sctp_output.c 359809 2020-04-11 20:36:54Z tuexen $"); #endif #include <netinet/sctp_os.h> @@ -13011,6 +13011,8 @@ sctp_send_str_reset_req(struct sctp_tcb *stcb, /* now anything on those queues? */ TAILQ_FOREACH_SAFE(sp, &oldstream[i].outqueue, next, nsp) { TAILQ_REMOVE(&oldstream[i].outqueue, sp, next); + sp->ss_next.tqe_next = NULL; + sp->ss_next.tqe_prev = NULL; TAILQ_INSERT_TAIL(&stcb->asoc.strmout[i].outqueue, sp, next); } |