git: e53b671b4f75 - stable/13 - socket: Release cred reference later in sodealloc()

[Mark Johnston]

The branch stable/13 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=e53b671b4f75fe86ace1cb78566ccdbdb56aad01

commit e53b671b4f75fe86ace1cb78566ccdbdb56aad01
Author:     Lv Yunlong <lylgood at foxmail.com>
AuthorDate: 2021-05-18 19:23:15 +0000
Commit:     Mark Johnston <markj at FreeBSD.org>
CommitDate: 2021-05-25 13:26:00 +0000

    socket: Release cred reference later in sodealloc()
    
    We dereference so->so_cred to update the per-uid socket buffer
    accounting, so the crfree() call must be deferred until after that
    point.
    
    PR:             255869
    
    (cherry picked from commit b295c5ddcef4744ef7044d2327b4258b6ad055f0)
---
 sys/kern/uipc_socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index 7f06b51cf096..3436004b53a6 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -475,7 +475,6 @@ sodealloc(struct socket *so)
 #endif
 	hhook_run_socket(so, NULL, HHOOK_SOCKET_CLOSE);
 
-	crfree(so->so_cred);
 	khelp_destroy_osd(&so->osd);
 	if (SOLISTENING(so)) {
 		if (so->sol_accept_filter != NULL)
@@ -492,6 +491,7 @@ sodealloc(struct socket *so)
 		SOCKBUF_LOCK_DESTROY(&so->so_snd);
 		SOCKBUF_LOCK_DESTROY(&so->so_rcv);
 	}
+	crfree(so->so_cred);
 	mtx_destroy(&so->so_lock);
 	uma_zfree(socket_zone, so);
 }