sctp: Clear assoc socket references when freeing a PCB
This restores behaviour present in the first import of SCTP. Commitceaad40ae7
commented this out and commit62fb761ff2
removed it. However, once sctp_inpcb_free() returns, the socket reference is gone no matter what, so we need to clear it. Reported by: syzbot+30dd69297fcbc5f0e10a@syzkaller.appspotmail.com Reported by: syzbot+7b2f9d4bcac1c9569291@syzkaller.appspotmail.com Reported by: syzbot+ed3e651f7d040af480a6@syzkaller.appspotmail.com Reviewed by: tuexen MFC after: 1 week Sponsored by: The FreeBSD Foundation Differential Revision: https://reviews.freebsd.org/D31886
This commit is contained in:
parent
395db99f32
commit
4250aa1188
@ -3358,6 +3358,7 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
|
||||
LIST_FOREACH_SAFE(asoc, &inp->sctp_asoc_list, sctp_tcblist, nasoc) {
|
||||
SCTP_TCB_LOCK(asoc);
|
||||
if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
|
||||
asoc->sctp_socket = NULL;
|
||||
/* Skip guys being freed */
|
||||
cnt_in_sd++;
|
||||
if (asoc->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
|
||||
|
Loading…
Reference in New Issue
Block a user