svn commit: r364545 - stable/12/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Sun Aug 23 21:12:37 2020
New Revision: 364545
URL: https://svnweb.freebsd.org/changeset/base/364545

Log:
  MFC r357768:
  Don't start an SCTP timer using a net, which has been removed.

Modified:
  stable/12/sys/netinet/sctp_pcb.c
  stable/12/sys/netinet/sctputil.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/sctp_pcb.c
==============================================================================
--- stable/12/sys/netinet/sctp_pcb.c	Sun Aug 23 21:10:24 2020	(r364544)
+++ stable/12/sys/netinet/sctp_pcb.c	Sun Aug 23 21:12:37 2020	(r364545)
@@ -4477,6 +4477,7 @@ out:
 	    SCTP_FROM_SCTP_PCB + SCTP_LOC_9);
 	sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 	    SCTP_FROM_SCTP_PCB + SCTP_LOC_10);
+	net->dest_state |= SCTP_ADDR_BEING_DELETED;
 	sctp_free_remote_addr(net);
 }
 

Modified: stable/12/sys/netinet/sctputil.c
==============================================================================
--- stable/12/sys/netinet/sctputil.c	Sun Aug 23 21:10:24 2020	(r364544)
+++ stable/12/sys/netinet/sctputil.c	Sun Aug 23 21:12:37 2020	(r364545)
@@ -2050,6 +2050,10 @@ sctp_timer_start(int t_type, struct sctp_inpcb *inp, s
 	if (stcb) {
 		SCTP_TCB_LOCK_ASSERT(stcb);
 	}
+	/* Don't restart timer on net that's been removed. */
+	if (net != NULL && (net->dest_state & SCTP_ADDR_BEING_DELETED)) {
+		return;
+	}
 	switch (t_type) {
 	case SCTP_TIMER_TYPE_ADDR_WQ:
 		/* Only 1 tick away :-) */