|
 |
b35c50 |
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
|
b35c50 |
From: Daniel Axtens <dja@axtens.net>
|
|
|
b35c50 |
Date: Tue, 1 Mar 2022 23:14:15 +1100
|
|
|
b35c50 |
Subject: [PATCH] net/http: Do not tear down socket if it's already been torn
|
|
|
b35c50 |
down
|
|
|
b35c50 |
|
|
|
b35c50 |
It's possible for data->sock to get torn down in tcp error handling.
|
|
|
b35c50 |
If we unconditionally tear it down again we will end up doing writes
|
|
|
b35c50 |
to an offset of the NULL pointer when we go to tear it down again.
|
|
|
b35c50 |
|
|
|
b35c50 |
Detect if it has been torn down and don't do it again.
|
|
|
b35c50 |
|
|
|
b35c50 |
Signed-off-by: Daniel Axtens <dja@axtens.net>
|
|
|
b35c50 |
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
|
|
|
b35c50 |
(cherry picked from commit ec233d3ecf995293304de443579aab5c46c49e85)
|
|
|
b35c50 |
---
|
|
|
b35c50 |
grub-core/net/http.c | 5 +++--
|
|
|
b35c50 |
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
b35c50 |
|
|
|
b35c50 |
diff --git a/grub-core/net/http.c b/grub-core/net/http.c
|
|
|
b35c50 |
index 7f878b5615..19cb8768e3 100644
|
|
|
b35c50 |
--- a/grub-core/net/http.c
|
|
|
b35c50 |
+++ b/grub-core/net/http.c
|
|
|
b35c50 |
@@ -427,7 +427,7 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)
|
|
|
b35c50 |
return err;
|
|
|
b35c50 |
}
|
|
|
b35c50 |
|
|
|
b35c50 |
- for (i = 0; !data->headers_recv && i < 100; i++)
|
|
|
b35c50 |
+ for (i = 0; data->sock && !data->headers_recv && i < 100; i++)
|
|
|
b35c50 |
{
|
|
|
b35c50 |
grub_net_tcp_retransmit ();
|
|
|
b35c50 |
grub_net_poll_cards (300, &data->headers_recv);
|
|
|
b35c50 |
@@ -435,7 +435,8 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)
|
|
|
b35c50 |
|
|
|
b35c50 |
if (!data->headers_recv)
|
|
|
b35c50 |
{
|
|
|
b35c50 |
- grub_net_tcp_close (data->sock, GRUB_NET_TCP_ABORT);
|
|
|
b35c50 |
+ if (data->sock)
|
|
|
b35c50 |
+ grub_net_tcp_close (data->sock, GRUB_NET_TCP_ABORT);
|
|
|
b35c50 |
if (data->err)
|
|
|
b35c50 |
{
|
|
|
b35c50 |
char *str = data->errmsg;
|