git: b295c5ddcef4 - main - socket: Release cred reference later in sodealloc()

[Mark Johnston]

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=b295c5ddcef4744ef7044d2327b4258b6ad055f0

commit b295c5ddcef4744ef7044d2327b4258b6ad055f0
Author:     Lv Yunlong <lylgood at foxmail.com>
AuthorDate: 2021-05-18 19:23:15 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-05-18 19:25:40 +0000

    socket: Release cred reference later in sodealloc()
    
    We dereference so->so_cred to update the per-uid socket buffer
    accounting, so the crfree() call must be deferred until after that
    point.
    
    PR:             255869
    MFC after:      1 week
---
 sys/kern/uipc_socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index ea86f66556ea..2a167eb68a22 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -476,7 +476,6 @@ sodealloc(struct socket *so)
 #endif
 	hhook_run_socket(so, NULL, HHOOK_SOCKET_CLOSE);
 
-	crfree(so->so_cred);
 	khelp_destroy_osd(&so->osd);
 	if (SOLISTENING(so)) {
 		if (so->sol_accept_filter != NULL)
@@ -493,6 +492,7 @@ sodealloc(struct socket *so)
 		SOCKBUF_LOCK_DESTROY(&so->so_snd);
 		SOCKBUF_LOCK_DESTROY(&so->so_rcv);
 	}
+	crfree(so->so_cred);
 	mtx_destroy(&so->so_lock);
 	uma_zfree(socket_zone, so);
 }