libnetworking: Fix close of active sockets

Send a special event to notify tasks waiting for a socket state change
in case this socket gets closed.  This prevents a use after free.

Close #785.

1 files changed, 12 insertions, 10 deletions

diff --git a/cpukit/libnetworking/rtems/rtems_syscall.c b/cpukit/libnetworking/rtems/rtems_syscall.c
index 324a634426..106379805e 100644
--- a/cpukit/libnetworking/rtems/rtems_syscall.c
+++ b/cpukit/libnetworking/rtems/rtems_syscall.c
@@ -204,17 +204,17 @@ connect (int s, struct sockaddr *name, int namelen)
 		rtems_bsdnet_semaphore_release ();
 		return -1;
 	}
-	while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) {
+	error = so->so_error;
+	while (error == 0 && (so->so_state & SS_ISCONNECTING)) {
 		error = soconnsleep (so);
 		if (error)
 			break;
-	}
-	if (error == 0) {
 		error = so->so_error;
 		so->so_error = 0;
 	}
     bad:
-	so->so_state &= ~SS_ISCONNECTING;
+	if (error != ENXIO)
+		so->so_state &= ~SS_ISCONNECTING;
 	m_freem (nam);
 	if (error)
 		errno = error;
@@ -249,6 +249,7 @@ accept (int s, struct sockaddr *name, int *namelen)
 	int fd;
 	struct socket *head, *so;
 	struct mbuf *nam;
+	int error;
 
 	rtems_bsdnet_semaphore_obtain ();
 	if ((head = rtems_bsdnet_fdToSocket (s)) == NULL) {
@@ -265,16 +266,16 @@ accept (int s, struct sockaddr *name, int *namelen)
 		rtems_bsdnet_semaphore_release ();
 		return -1;
 	}
-        while (head->so_comp.tqh_first == NULL && head->so_error == 0) {
+	error = head->so_error;
+        while (error ==  0 && head->so_comp.tqh_first == NULL) {
                 if (head->so_state & SS_CANTRCVMORE) {
-                        head->so_error = ECONNABORTED;
+                        error = ECONNABORTED;
                         break;
                 }
-		head->so_error = soconnsleep (head);
+		error = soconnsleep (head);
         }
-	if (head->so_error) {
-		errno = head->so_error;
-		head->so_error = 0;
+	if (error) {
+		errno = error;
 		rtems_bsdnet_semaphore_release ();
 		return -1;
 	}
@@ -715,6 +716,7 @@ rtems_bsdnet_close (rtems_libio_t *iop)
 		rtems_bsdnet_semaphore_release ();
 		return -1;
 	}
+	iop->data1 = NULL;
 	error = soclose (so);
 	rtems_bsdnet_semaphore_release ();
 	if (error) {