Blame SOURCES/0531-net-http-Do-not-tear-down-socket-if-it-s-already-bee.patch

b9d01e
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
b9d01e
From: Daniel Axtens <dja@axtens.net>
b9d01e
Date: Tue, 1 Mar 2022 23:14:15 +1100
b9d01e
Subject: [PATCH] net/http: Do not tear down socket if it's already been torn
b9d01e
 down
b9d01e
b9d01e
It's possible for data->sock to get torn down in tcp error handling.
b9d01e
If we unconditionally tear it down again we will end up doing writes
b9d01e
to an offset of the NULL pointer when we go to tear it down again.
b9d01e
b9d01e
Detect if it has been torn down and don't do it again.
b9d01e
b9d01e
Signed-off-by: Daniel Axtens <dja@axtens.net>
b9d01e
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
b9d01e
(cherry picked from commit ec233d3ecf995293304de443579aab5c46c49e85)
b9d01e
(cherry picked from commit d39cf87ed701b9f0900daed7f672e07994d37ce8)
b9d01e
(cherry picked from commit e0aa5c3acec70eac3489d6df1893a93726cbce3a)
b9d01e
---
b9d01e
 grub-core/net/http.c | 5 +++--
b9d01e
 1 file changed, 3 insertions(+), 2 deletions(-)
b9d01e
b9d01e
diff --git a/grub-core/net/http.c b/grub-core/net/http.c
b9d01e
index b52b558d63..5223ca57a4 100644
b9d01e
--- a/grub-core/net/http.c
b9d01e
+++ b/grub-core/net/http.c
b9d01e
@@ -427,7 +427,7 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)
b9d01e
       return err;
b9d01e
     }
b9d01e
 
b9d01e
-  for (i = 0; !data->headers_recv && i < 100; i++)
b9d01e
+  for (i = 0; data->sock && !data->headers_recv && i < 100; i++)
b9d01e
     {
b9d01e
       grub_net_tcp_retransmit ();
b9d01e
       grub_net_poll_cards (300, &data->headers_recv);
b9d01e
@@ -435,7 +435,8 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)
b9d01e
 
b9d01e
   if (!data->headers_recv)
b9d01e
     {
b9d01e
-      grub_net_tcp_close (data->sock, GRUB_NET_TCP_ABORT);
b9d01e
+      if (data->sock)
b9d01e
+        grub_net_tcp_close (data->sock, GRUB_NET_TCP_ABORT);
b9d01e
       if (data->err)
b9d01e
 	{
b9d01e
 	  char *str = data->errmsg;