svn commit: r345525 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Tue Mar 26 08:27:00 2019
New Revision: 345525
URL: https://svnweb.freebsd.org/changeset/base/345525

Log:
  Fix a double free of an SCTP association in an error path.
  This is joint work with rrs at . The issue was found by running
  syzkaller.
  
  MFC after:		1 week

Modified:
  head/sys/netinet/sctp_usrreq.c

Modified: head/sys/netinet/sctp_usrreq.c
==============================================================================
--- head/sys/netinet/sctp_usrreq.c	Tue Mar 26 08:10:51 2019	(r345524)
+++ head/sys/netinet/sctp_usrreq.c	Tue Mar 26 08:27:00 2019	(r345525)
@@ -1481,8 +1481,6 @@ sctp_do_connect_x(struct socket *so, struct sctp_inpcb
 	sctp_connectx_helper_add(stcb, sa, (totaddr - 1), &error);
 	/* Fill in the return id */
 	if (error) {
-		(void)sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE,
-		    SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
 		goto out_now;
 	}
 	a_id = (sctp_assoc_t *)optval;