svn commit: r347118 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Sat May  4 12:54:24 2019
New Revision: 347118
URL: https://svnweb.freebsd.org/changeset/base/347118

Log:
  MFC r345504:
  Improve locking when tearing down an SCTP association.
  This is joint work with rrs@ and the issue was found by
  syzkaller.

Modified:
  stable/12/sys/netinet/sctp_pcb.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_pcb.c
==============================================================================
--- stable/12/sys/netinet/sctp_pcb.c	Sat May  4 12:52:24 2019	(r347117)
+++ stable/12/sys/netinet/sctp_pcb.c	Sat May  4 12:54:24 2019	(r347118)
@@ -4982,6 +4982,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc
 	 * in case.
 	 */
 	/* anything on the wheel needs to be removed */
+	SCTP_TCB_SEND_LOCK(stcb);
 	for (i = 0; i < asoc->streamoutcnt; i++) {
 		struct sctp_stream_out *outs;
 
@@ -4990,7 +4991,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc
 		TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
 			atomic_subtract_int(&asoc->stream_queue_cnt, 1);
 			TAILQ_REMOVE(&outs->outqueue, sp, next);
-			stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 0);
+			stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
 			sctp_free_spbufspace(stcb, asoc, sp);
 			if (sp->data) {
 				if (so) {
@@ -5012,6 +5013,7 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc
 			sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED);
 		}
 	}
+	SCTP_TCB_SEND_UNLOCK(stcb);
 	/* sa_ignore FREED_MEMORY */
 	TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) {
 		TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);