svn commit: r357768 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Tue Feb 11 18:15:57 2020
New Revision: 357768
URL: https://svnweb.freebsd.org/changeset/base/357768

Log:
  Don't start an SCTP timer using a net, which has been removed.
  
  Submitted by:		Taylor Brandstetter
  MFC after:		1 week

Modified:
  head/sys/netinet/sctp_pcb.c
  head/sys/netinet/sctputil.c

Modified: head/sys/netinet/sctp_pcb.c
==============================================================================
--- head/sys/netinet/sctp_pcb.c	Tue Feb 11 18:15:23 2020	(r357767)
+++ head/sys/netinet/sctp_pcb.c	Tue Feb 11 18:15:57 2020	(r357768)
@@ -4480,6 +4480,7 @@ out:
 	    SCTP_FROM_SCTP_PCB + SCTP_LOC_9);
 	sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 	    SCTP_FROM_SCTP_PCB + SCTP_LOC_10);
+	net->dest_state |= SCTP_ADDR_BEING_DELETED;
 	sctp_free_remote_addr(net);
 }
 

Modified: head/sys/netinet/sctputil.c
==============================================================================
--- head/sys/netinet/sctputil.c	Tue Feb 11 18:15:23 2020	(r357767)
+++ head/sys/netinet/sctputil.c	Tue Feb 11 18:15:57 2020	(r357768)
@@ -2050,6 +2050,10 @@ sctp_timer_start(int t_type, struct sctp_inpcb *inp, s
 	if (stcb) {
 		SCTP_TCB_LOCK_ASSERT(stcb);
 	}
+	/* Don't restart timer on net that's been removed. */
+	if (net != NULL && (net->dest_state & SCTP_ADDR_BEING_DELETED)) {
+		return;
+	}
 	switch (t_type) {
 	case SCTP_TIMER_TYPE_ADDR_WQ:
 		/* Only 1 tick away :-) */