Page MenuHomeFreeBSD

sctp: Hold association locks across socket wakeups when freeing
ClosedPublic

Authored by markj on Aug 31 2021, 4:18 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sep 9 2025, 7:37 PM
Unknown Object (File)
Sep 7 2025, 1:45 PM
Unknown Object (File)
Sep 3 2025, 3:41 PM
Unknown Object (File)
Aug 21 2025, 1:06 AM
Unknown Object (File)
Aug 14 2025, 11:05 PM
Unknown Object (File)
Jun 29 2025, 3:35 PM
Unknown Object (File)
Jun 15 2025, 1:21 PM
Unknown Object (File)
May 22 2025, 8:47 AM
Subscribers

Details

Summary

At this point we do not hold the inpcb lock, so the only thing holding
the socket reference live is the TCB lock, which needs to be acquired by
sctp_inpcb_free() in order to destroy associations. Defer the unlock
until after we dereference the socket reference.

Reported by: syzbot+1d0f2c4675de76a4cf1e@syzkaller.appspotmail.com
Reported by: syzbot+fabee77954fe69d3a5ad@syzkaller.appspotmail.com

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable