svn commit: r304428 - stable/11/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Thu Aug 18 12:51:26 2016
New Revision: 304428
URL: https://svnweb.freebsd.org/changeset/base/304428

Log:
  MFC r304146:
  Ensure that sctp_it_ctl.cur_it does not point to a free object (during
  a small time window).
  Thanks to Byron Campen for reporting the issue and
  suggesting a fix.

Modified:
  stable/11/sys/netinet/sctputil.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/netinet/sctputil.c
==============================================================================
--- stable/11/sys/netinet/sctputil.c	Thu Aug 18 12:09:20 2016	(r304427)
+++ stable/11/sys/netinet/sctputil.c	Thu Aug 18 12:51:26 2016	(r304428)
@@ -1280,6 +1280,7 @@ sctp_iterator_work(struct sctp_iterator 
 
 	SCTP_INP_INFO_RLOCK();
 	SCTP_ITERATOR_LOCK();
+	sctp_it_ctl.cur_it = it;
 	if (it->inp) {
 		SCTP_INP_RLOCK(it->inp);
 		SCTP_INP_DECR_REF(it->inp);
@@ -1287,6 +1288,7 @@ sctp_iterator_work(struct sctp_iterator 
 	if (it->inp == NULL) {
 		/* iterator is complete */
 done_with_iterator:
+		sctp_it_ctl.cur_it = NULL;
 		SCTP_ITERATOR_UNLOCK();
 		SCTP_INP_INFO_RUNLOCK();
 		if (it->function_atend != NULL) {
@@ -1427,13 +1429,11 @@ sctp_iterator_worker(void)
 
 	sctp_it_ctl.iterator_running = 1;
 	TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
-		sctp_it_ctl.cur_it = it;
 		/* now lets work on this one */
 		TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
 		SCTP_IPI_ITERATOR_WQ_UNLOCK();
 		CURVNET_SET(it->vn);
 		sctp_iterator_work(it);
-		sctp_it_ctl.cur_it = NULL;
 		CURVNET_RESTORE();
 		SCTP_IPI_ITERATOR_WQ_LOCK();
 		/* sa_ignore FREED_MEMORY */