Lock ACCEPT_LOCK before checking socket->so_head. (#698)

sctplab · Apr 17, 2024 · 5335d22 · 5335d22
1 parent e8da239
commit 5335d22
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/usrsctplib/netinet/sctp_input.c b/usrsctplib/netinet/sctp_input.c
@@ -5934,6 +5934,7 @@ sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int lengt
 	if ((stcb != NULL) &&
 	    ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) &&
 	    (stcb->sctp_socket != NULL)) {
+		ACCEPT_LOCK();
 		if (stcb->sctp_socket->so_head != NULL) {
 			upcall_socket = stcb->sctp_socket->so_head;
 		} else {
@@ -5942,6 +5943,7 @@ sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int lengt
 		SOCK_LOCK(upcall_socket);
 		soref(upcall_socket);
 		SOCK_UNLOCK(upcall_socket);
+		ACCEPT_UNLOCK();
 	}
 #endif
 	if (IS_SCTP_CONTROL(ch)) {
@@ -6037,6 +6039,7 @@ sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int lengt
 	if ((upcall_socket == NULL) &&
 	    ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) &&
 	    (stcb->sctp_socket != NULL)) {
+		ACCEPT_LOCK();
 		if (stcb->sctp_socket->so_head != NULL) {
 			upcall_socket = stcb->sctp_socket->so_head;
 		} else {
@@ -6045,6 +6048,7 @@ sctp_common_input_processing(struct mbuf **mm, int iphlen, int offset, int lengt
 		SOCK_LOCK(upcall_socket);
 		soref(upcall_socket);
 		SOCK_UNLOCK(upcall_socket);
+		ACCEPT_UNLOCK();
 	}
 #endif