From dad94fffe14be476df5f34a8e5a90ea62a41fe12 Mon Sep 17 00:00:00 2001

From: Daniel Axtens <dja@axtens.net>

Date: Tue, 1 Mar 2022 23:14:15 +1100

Subject: [PATCH 6/8] net/http: Do not tear down socket if it's already been

 torn down

It's possible for data->sock to get torn down in tcp error handling.

If we unconditionally tear it down again we will end up doing writes

to an offset of the NULL pointer when we go to tear it down again.

Detect if it has been torn down and don't do it again.

Signed-off-by: Daniel Axtens <dja@axtens.net>

Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>

---

 grub-core/net/http.c | 5 +++--

 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/grub-core/net/http.c b/grub-core/net/http.c

index 8d6c62c76..f8d7bf0cd 100644

--- a/grub-core/net/http.c

+++ b/grub-core/net/http.c

@@ -445,7 +445,7 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)

       return err;

     }

-  for (i = 0; !data->headers_recv && i < 100; i++)

+  for (i = 0; data->sock && !data->headers_recv && i < 100; i++)

     {

       grub_net_tcp_retransmit ();

       grub_net_poll_cards (300, &data->headers_recv);

@@ -453,7 +453,8 @@ http_establish (struct grub_file *file, grub_off_t offset, int initial)

   if (!data->headers_recv)

     {

-      grub_net_tcp_close (data->sock, GRUB_NET_TCP_ABORT);

+      if (data->sock)

+        grub_net_tcp_close (data->sock, GRUB_NET_TCP_ABORT);

       if (data->err)

 	{

 	  char *str = data->errmsg;

-- 

2.33.5