diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2021-09-09 12:33:26 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-09-16 12:37:53 +0000 |
| commit | adfb7f807c662a69afc0b775ccf070cfab04aac5 (patch) | |
| tree | 3d25a4e84459ad36484335318cbed68db5565a8f /sys/netinet/sctp_pcb.c | |
| parent | 1cce9f8fecf2ccf8fe908815aa8568727df37c81 (diff) | |
sctp: Clear assoc socket references when freeing a PCB
This restores behaviour present in the first import of SCTP. Commit
ceaad40ae729dea2c5d8ffcfdd45bb96fb8969d2 commented this out and commit
62fb761ff28bb184a2543e539dd689fefd5d3246 removed it. However, once
sctp_inpcb_free() returns, the socket reference is gone no matter what,
so we need to clear it.
Reported by: syzbot+30dd69297fcbc5f0e10a@syzkaller.appspotmail.com
Reported by: syzbot+7b2f9d4bcac1c9569291@syzkaller.appspotmail.com
Reported by: syzbot+ed3e651f7d040af480a6@syzkaller.appspotmail.com
Reviewed by: tuexen
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 4250aa1188b5622a6cef871003abd4a50067bdae)
Diffstat (limited to 'sys/netinet/sctp_pcb.c')
| -rw-r--r-- | sys/netinet/sctp_pcb.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c index 85ea5a3f8a53..7e0c0562e8a9 100644 --- a/sys/netinet/sctp_pcb.c +++ b/sys/netinet/sctp_pcb.c @@ -3359,6 +3359,7 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from) LIST_FOREACH_SAFE(asoc, &inp->sctp_asoc_list, sctp_tcblist, nasoc) { SCTP_TCB_LOCK(asoc); if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) { + asoc->sctp_socket = NULL; /* Skip guys being freed */ cnt_in_sd++; if (asoc->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) { |