Page MenuHomeFreeBSD

sctp: Clear assoc socket references when freeing a PCB
ClosedPublic

Authored by markj on Sep 8 2021, 9:32 PM.
Tags
None
Referenced Files
F166014062: D31886.id94914.diff
Tue, Aug 11, 1:19 AM
F166012341: D31886.diff
Tue, Aug 11, 12:58 AM
F166000006: D31886.id94906.diff
Mon, Aug 10, 10:13 PM
Unknown Object (File)
Mon, Aug 10, 10:31 AM
Unknown Object (File)
Mon, Aug 10, 10:31 AM
Unknown Object (File)
Mon, Aug 10, 8:18 AM
Unknown Object (File)
Fri, Aug 7, 7:12 PM
Unknown Object (File)
Jul 10 2026, 3:30 PM
Subscribers

Details

Summary

This restores behaviour present in the first import of SCTP. Commit
ceaad40ae729dea2c5d8ffcfdd45bb96fb8969d2 commented this out and commit
62fb761ff28bb184a2543e539dd689fefd5d3246 removed it. However, once
sctp_inpcb_free() returns, the socket reference is gone no matter what,
so we need to clear it. In particular, it's possible for
sctp_free_assoc() to set SCTP_STATE_ABOUT_TO_BE_FREED and then return
without actually freeing the association.

Reported by: syzbot+30dd69297fcbc5f0e10a@syzkaller.appspotmail.com

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable