git: d35be50f5779 - main - sctp: Hold association locks across socket wakeups when freeing

[Mark Johnston]

The branch main has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=d35be50f57797a400ff68a37777405029bf9730a

commit d35be50f57797a400ff68a37777405029bf9730a
Author:     Mark Johnston <markj at FreeBSD.org>
AuthorDate: 2021-09-01 14:27:51 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-09-01 14:27:51 +0000

    sctp: Hold association locks across socket wakeups when freeing
    
    At this point we do not hold the inpcb lock, so the only thing holding
    the socket reference live is the TCB lock, which needs to be acquired by
    sctp_inpcb_free() in order to destroy associations.  Defer the unlock to
    until after we dereference the socket reference.
    
    Reported by:    syzbot+1d0f2c4675de76a4cf1e at syzkaller.appspotmail.com
    Reported by:    syzbot+fabee77954fe69d3a5ad at syzkaller.appspotmail.com
    Reviewed by:    tuexen
    MFC after:      1 week
    Sponsored by:   The FreeBSD Foundation
    Differential Revision:  https://reviews.freebsd.org/D31754
---
 sys/netinet/sctp_pcb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c
index 2b8653ac8109..3e517889d171 100644
--- a/sys/netinet/sctp_pcb.c
+++ b/sys/netinet/sctp_pcb.c
@@ -4802,8 +4802,6 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 			SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
 			sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
 		}
-		SCTP_TCB_SEND_UNLOCK(stcb);
-		SCTP_TCB_UNLOCK(stcb);
 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
 			/* nothing around */
@@ -4813,6 +4811,8 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 			sctp_sorwakeup(inp, so);
 			sctp_sowwakeup(inp, so);
 		}
+		SCTP_TCB_SEND_UNLOCK(stcb);
+		SCTP_TCB_UNLOCK(stcb);
 
 #ifdef SCTP_LOG_CLOSING
 		sctp_log_closing(inp, stcb, 9);