Blame SOURCES/0531-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch

0ccc47
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
0ccc47
From: Daniel Axtens <dja@axtens.net>
0ccc47
Date: Tue, 1 Mar 2022 23:14:15 +1100
0ccc47
Subject: [PATCH] net/http: Do not tear down socket if it's already been torn
0ccc47
 down
0ccc47
0ccc47
It's possible for data->sock to get torn down in tcp error handling.
0ccc47
If we unconditionally tear it down again we will end up doing writes
0ccc47
to an offset of the NULL pointer when we go to tear it down again.
0ccc47
0ccc47
Detect if it has been torn down and don't do it again.
0ccc47
0ccc47
Signed-off-by: Daniel Axtens <dja@axtens.net>
0ccc47
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
0ccc47
(cherry picked from commit ec233d3ecf995293304de443579aab5c46c49e85)
0ccc47
(cherry picked from commit d39cf87ed701b9f0900daed7f672e07994d37ce8)
0ccc47
(cherry picked from commit e0aa5c3acec70eac3489d6df1893a93726cbce3a)
0ccc47
---
0ccc47
 grub-core/net/http.c | 5 +++--
0ccc47
 1 file changed, 3 insertions(+), 2 deletions(-)
0ccc47
0ccc47
diff --git a/grub-core/net/http.c b/grub-core/net/http.c
0ccc47
index b52b558d63..5223ca57a4 100644
0ccc47
--- a/grub-core/net/http.c
0ccc47
+++ b/grub-core/net/http.c
0ccc47
@@ -427,7 +427,7 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)
0ccc47
       return err;
0ccc47
     }
0ccc47
 
0ccc47
-  for (i = 0; !data->headers_recv && i < 100; i++)
0ccc47
+  for (i = 0; data->sock && !data->headers_recv && i < 100; i++)
0ccc47
     {
0ccc47
       grub_net_tcp_retransmit ();
0ccc47
       grub_net_poll_cards (300, &data->headers_recv);
0ccc47
@@ -435,7 +435,8 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)
0ccc47
 
0ccc47
   if (!data->headers_recv)
0ccc47
     {
0ccc47
-      grub_net_tcp_close (data->sock, GRUB_NET_TCP_ABORT);
0ccc47
+      if (data->sock)
0ccc47
+        grub_net_tcp_close (data->sock, GRUB_NET_TCP_ABORT);
0ccc47
       if (data->err)
0ccc47
 	{
0ccc47
 	  char *str = data->errmsg;