svn commit: r351974 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Sat Sep  7 10:51:33 2019
New Revision: 351974
URL: https://svnweb.freebsd.org/changeset/base/351974

Log:
  MFC r349998:
  
  Fix socket state handling when freeing an SCTP endpoint.
  
  This issue was found by runing syzkaller.

Modified:
  stable/12/sys/netinet/sctp_pcb.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_pcb.c
==============================================================================
--- stable/12/sys/netinet/sctp_pcb.c	Sat Sep  7 10:49:37 2019	(r351973)
+++ stable/12/sys/netinet/sctp_pcb.c	Sat Sep  7 10:51:33 2019	(r351974)
@@ -4912,12 +4912,11 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tc
 			inp->sctp_flags |= SCTP_PCB_FLAGS_WAS_CONNECTED;
 			if (so) {
 				SOCKBUF_LOCK(&so->so_rcv);
-				if (so->so_rcv.sb_cc == 0) {
-					so->so_state &= ~(SS_ISCONNECTING |
-					    SS_ISDISCONNECTING |
-					    SS_ISCONFIRMING |
-					    SS_ISCONNECTED);
-				}
+				so->so_state &= ~(SS_ISCONNECTING |
+				    SS_ISDISCONNECTING |
+				    SS_ISCONFIRMING |
+				    SS_ISCONNECTED);
+				so->so_state |= SS_ISDISCONNECTED;
 				socantrcvmore_locked(so);
 				socantsendmore(so);
 				sctp_sowwakeup(inp, so);