git: 3ff3733991ba - main - sctp: don't keep being locked on a stream which is removed

[Michael Tuexen]

The branch main has been updated by tuexen:

URL: https://cgit.FreeBSD.org/src/commit/?id=3ff3733991ba049959c4fd2e7179ea96241a396e

commit 3ff3733991ba049959c4fd2e7179ea96241a396e
Author:     Michael Tuexen <tuexen at FreeBSD.org>
AuthorDate: 2021-10-01 22:48:01 +0000
Commit:     Michael Tuexen <tuexen at FreeBSD.org>
CommitDate: 2021-10-01 22:48:01 +0000

    sctp: don't keep being locked on a stream which is removed
    
    Reported by:    syzbot+f5f551e8a3a0302a4914 at syzkaller.appspotmail.com
    MFC after:      1 week
---
 sys/netinet/sctp_ss_functions.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/sys/netinet/sctp_ss_functions.c b/sys/netinet/sctp_ss_functions.c
index 5293c0fee742..c08bec07c588 100644
--- a/sys/netinet/sctp_ss_functions.c
+++ b/sys/netinet/sctp_ss_functions.c
@@ -150,6 +150,9 @@ sctp_ss_default_remove(struct sctp_tcb *stcb, struct sctp_association *asoc,
 				asoc->ss_data.last_out_stream = NULL;
 			}
 		}
+		if (asoc->ss_data.locked_on_sending == strq) {
+			asoc->ss_data.locked_on_sending = NULL;
+		}
 		TAILQ_REMOVE(&asoc->ss_data.out.wheel, strq, ss_params.ss.rr.next_spoke);
 		strq->ss_params.scheduled = false;
 	}
@@ -466,6 +469,9 @@ sctp_ss_prio_remove(struct sctp_tcb *stcb, struct sctp_association *asoc,
 				asoc->ss_data.last_out_stream = NULL;
 			}
 		}
+		if (asoc->ss_data.locked_on_sending == strq) {
+			asoc->ss_data.locked_on_sending = NULL;
+		}
 		TAILQ_REMOVE(&asoc->ss_data.out.wheel, strq, ss_params.ss.prio.next_spoke);
 		strq->ss_params.scheduled = false;
 	}
@@ -635,6 +641,9 @@ sctp_ss_fb_remove(struct sctp_tcb *stcb, struct sctp_association *asoc,
 				asoc->ss_data.last_out_stream = NULL;
 			}
 		}
+		if (asoc->ss_data.locked_on_sending == strq) {
+			asoc->ss_data.locked_on_sending = NULL;
+		}
 		TAILQ_REMOVE(&asoc->ss_data.out.wheel, strq, ss_params.ss.fb.next_spoke);
 		strq->ss_params.scheduled = false;
 	}