The branch stable/13 has been updated by tuexen:
URL:
https://cgit.FreeBSD.org/src/commit/?id=d7351c4104a3dbd793f2ae7303cfdd948fc229ff
commit d7351c4104a3dbd793f2ae7303cfdd948fc229ff
Author: Michael Tuexen <tue...@freebsd.org>
AuthorDate: 2021-09-28 03:14:56 +0000
Commit: Michael Tuexen <tue...@freebsd.org>
CommitDate: 2022-02-22 22:55:45 +0000
sctp: avoid locking an already locked mutex
Reported by: syzbot+f048680690f2e8d7d...@syzkaller.appspotmail.com
Reported by: syzbot+0725c712ba89d123c...@syzkaller.appspotmail.com
(cherry picked from commit 171633765c4367dc233a4bf0e5926cb7c4decfc1)
---
sys/netinet/sctp_timer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sys/netinet/sctp_timer.c b/sys/netinet/sctp_timer.c
index c994b90b8353..17d834cd2734 100644
--- a/sys/netinet/sctp_timer.c
+++ b/sys/netinet/sctp_timer.c
@@ -1387,6 +1387,7 @@ sctp_audit_stream_queues_for_size(struct sctp_inpcb *inp,
struct sctp_tcb *stcb)
SCTP_PRINTF("Hmm, stream queue cnt at %d I counted %d in stream
out wheel\n",
stcb->asoc.stream_queue_cnt, chks_in_queue);
}
+ SCTP_TCB_SEND_UNLOCK(stcb);
if (chks_in_queue) {
/* call the output queue function */
sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3,
SCTP_SO_NOT_LOCKED);
@@ -1406,7 +1407,6 @@ sctp_audit_stream_queues_for_size(struct sctp_inpcb *inp,
struct sctp_tcb *stcb)
(u_long)stcb->asoc.total_output_queue_size);
stcb->asoc.total_output_queue_size = 0;
}
- SCTP_TCB_SEND_UNLOCK(stcb);
}
int
