git: 3a84efbedca5 - stable/12 - socket: Release cred reference later in sodealloc()

[Mark Johnston]

The branch stable/12 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=3a84efbedca5c8c45e40bdcaa4e1ae0e15fff94d

commit 3a84efbedca5c8c45e40bdcaa4e1ae0e15fff94d
Author:     Lv Yunlong <lylgood at foxmail.com>
AuthorDate: 2021-05-18 19:23:15 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-05-25 13:28:54 +0000

    socket: Release cred reference later in sodealloc()
    
    We dereference so->so_cred to update the per-uid socket buffer
    accounting, so the crfree() call must be deferred until after that
    point.
    
    PR:             255869
    
    (cherry picked from commit b295c5ddcef4744ef7044d2327b4258b6ad055f0)
---
 sys/kern/uipc_socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index ab05da880e46..dd028c660d2b 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -467,7 +467,6 @@ sodealloc(struct socket *so)
 #endif
 	hhook_run_socket(so, NULL, HHOOK_SOCKET_CLOSE);
 
-	crfree(so->so_cred);
 	khelp_destroy_osd(&so->osd);
 	if (SOLISTENING(so)) {
 		if (so->sol_accept_filter != NULL)
@@ -484,6 +483,7 @@ sodealloc(struct socket *so)
 		SOCKBUF_LOCK_DESTROY(&so->so_snd);
 		SOCKBUF_LOCK_DESTROY(&so->so_rcv);
 	}
+	crfree(so->so_cred);
 	mtx_destroy(&so->so_lock);
 	uma_zfree(socket_zone, so);
 }