git: 2a93ba42c49a - stable/13 - sctp: improve stopping of timers

The branch stable/13 has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=2a93ba42c49a130bc56cb3cf2092a8e35a8d2b04

commit 2a93ba42c49a130bc56cb3cf2092a8e35a8d2b04
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2022-04-19 19:29:41 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2023-02-01 22:45:08 +0000

    sctp: improve stopping of timers
    
    Reported by:    syzbot+c9c70062320aaad19de7@syzkaller.appspotmail.com
    MFC after:      3 days
    
    (cherry picked from commit 868868f14efcd7e127dae6e87550357c6cdb9c6d)
---
 sys/netinet/sctputil.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/sys/netinet/sctputil.c b/sys/netinet/sctputil.c
index 45e06ef769e0..5f18e564cf21 100644
--- a/sys/netinet/sctputil.c
+++ b/sys/netinet/sctputil.c
@@ -2869,20 +2869,23 @@ sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 		 * counts that were incremented in sctp_timer_start().
 		 */
 		if (tmr->ep != NULL) {
-			SCTP_INP_DECR_REF(inp);
 			tmr->ep = NULL;
+			SCTP_INP_DECR_REF(inp);
 		}
 		if (tmr->tcb != NULL) {
-			atomic_subtract_int(&stcb->asoc.refcnt, 1);
 			tmr->tcb = NULL;
+			atomic_subtract_int(&stcb->asoc.refcnt, 1);
 		}
 		if (tmr->net != NULL) {
+			struct sctp_nets *tmr_net;
+
 			/*
 			 * Can't use net, since it doesn't work for
 			 * SCTP_TIMER_TYPE_ASCONF.
 			 */
-			sctp_free_remote_addr((struct sctp_nets *)tmr->net);
+			tmr_net = tmr->net;
 			tmr->net = NULL;
+			sctp_free_remote_addr((struct sctp_nets *)tmr_net);
 		}
 	} else {
 		SCTPDBG(SCTP_DEBUG_TIMER2,