git: 2bf685d16aa7 - stable/13 - sctp: clear pointer to stack when returning from function.

The branch stable/13 has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=2bf685d16aa76eb7d93ed0b50aef4183e0ce77ee

commit 2bf685d16aa76eb7d93ed0b50aef4183e0ce77ee
Author:     Michael Tuexen <tuexen@FreeBSD.org>
AuthorDate: 2022-04-01 22:54:49 +0000
Commit:     Michael Tuexen <tuexen@FreeBSD.org>
CommitDate: 2023-02-01 22:29:03 +0000

    sctp: clear pointer to stack when returning from function.
    
    Reported by:    syzbot+04cee5d8805dfbb63c06@syzkaller.appspotmail.com
    Reported by:    syzbot+71e7e33dfc3cc39a6bd0@syzkaller.appspotmail.com
    Reported by:    syzbot+6c36fc3c1bd03ed96107@syzkaller.appspotmail.com
    Reported by:    syzbot+198b3751c158181c47de@syzkaller.appspotmail.com
    
    (cherry picked from commit 39a22011bbb820b389ce8ad166f7bdce112a75cc)
---
 sys/netinet/sctp_output.c | 38 ++++++++++++++++++--------------------
 1 file changed, 18 insertions(+), 20 deletions(-)

diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c
index 7e5c84228ecb..39a6140fd36c 100644
--- a/sys/netinet/sctp_output.c
+++ b/sys/netinet/sctp_output.c
@@ -12991,21 +12991,21 @@ sctp_lower_sosend(struct socket *so,
 			SCTP_TCB_UNLOCK(stcb);
 			hold_tcblock = false;
 			error = sbwait(&so->so_snd);
-			if (error || so->so_error || be.error) {
-				if (error == 0) {
-					if (so->so_error != 0) {
-						error = so->so_error;
-					}
-					if (be.error != 0) {
-						error = be.error;
-					}
+			if (error == 0) {
+				if (so->so_error != 0) {
+					error = so->so_error;
+				}
+				if (be.error != 0) {
+					error = be.error;
 				}
-				SOCKBUF_UNLOCK(&so->so_snd);
-				goto out_unlocked;
 			}
 			SOCKBUF_UNLOCK(&so->so_snd);
 			SCTP_TCB_LOCK(stcb);
 			hold_tcblock = true;
+			stcb->block_entry = NULL;
+			if (error != 0) {
+				goto out_unlocked;
+			}
 			if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) ||
 			    (asoc->state & SCTP_STATE_WAS_ABORTED)) {
 				if (asoc->state & SCTP_STATE_WAS_ABORTED) {
@@ -13019,7 +13019,6 @@ sctp_lower_sosend(struct socket *so,
 				}
 				goto out_unlocked;
 			}
-			stcb->block_entry = NULL;
 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) {
 				sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
 				    asoc, asoc->total_output_queue_size);
@@ -13352,14 +13351,14 @@ skip_preblock:
 				SCTP_TCB_UNLOCK(stcb);
 				hold_tcblock = false;
 				error = sbwait(&so->so_snd);
-				if (error || so->so_error || be.error) {
-					if (error == 0) {
-						if (so->so_error)
-							error = so->so_error;
-						if (be.error) {
-							error = be.error;
-						}
+				if (error == 0) {
+					if (so->so_error != 0)
+						error = so->so_error;
+					if (be.error != 0) {
+						error = be.error;
 					}
+				}
+				if (error != 0) {
 					SOCKBUF_UNLOCK(&so->so_snd);
 					SCTP_TCB_LOCK(stcb);
 					hold_tcblock = true;
@@ -13371,12 +13370,12 @@ skip_preblock:
 					}
 					goto out_unlocked;
 				}
-
 			}
 			SOCKBUF_UNLOCK(&so->so_snd);
 			if (!hold_tcblock) {
 				SCTP_TCB_LOCK(stcb);
 				hold_tcblock = true;
+				stcb->block_entry = NULL;
 				if ((asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) ||
 				    (asoc->state & SCTP_STATE_WAS_ABORTED)) {
 					if (asoc->state & SCTP_STATE_WAS_ABORTED) {
@@ -13392,7 +13391,6 @@ skip_preblock:
 					goto out;
 				}
 			}
-			stcb->block_entry = NULL;
 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_BLK_LOGGING_ENABLE) {
 				sctp_log_block(SCTP_BLOCK_LOG_OUTOF_BLK,
 				    asoc, asoc->total_output_queue_size);