svn commit: r343954 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Sun Feb 10 10:42:16 2019
New Revision: 343954
URL: https://svnweb.freebsd.org/changeset/base/343954

Log:
  Fix a locking bug in the IPPROTO_SCTP level SCTP_EVENT socket option.
  This occurs when call setsockopt() with invalid parameters.
  
  This issue was found by syzkaller.
  
  MFC after:		3 days

Modified:
  head/sys/netinet/sctp_usrreq.c

Modified: head/sys/netinet/sctp_usrreq.c
==============================================================================
--- head/sys/netinet/sctp_usrreq.c	Sun Feb 10 08:46:07 2019	(r343953)
+++ head/sys/netinet/sctp_usrreq.c	Sun Feb 10 10:42:16 2019	(r343954)
@@ -6115,6 +6115,10 @@ sctp_setopt(struct socket *so, int optname, void *optv
 						SCTP_INP_RUNLOCK(inp);
 					}
 				}
+			} else {
+				if (stcb) {
+					SCTP_TCB_UNLOCK(stcb);
+				}
 			}
 			break;
 		}