The branch main has been updated by tuexen:
URL:
https://cgit.FreeBSD.org/src/commit/?id=a12d89332efe0b02307c580a6f3025652374cd47
commit a12d89332efe0b02307c580a6f3025652374cd47
Author: Michael Tuexen <tue...@freebsd.org>
AuthorDate: 2022-04-19 11:03:08 +0000
Commit: Michael Tuexen <tue...@freebsd.org>
CommitDate: 2022-04-19 11:03:08 +0000
sctp: hold the inp lock while calling ip6_output
This fixes an issue with handling IPPROTO_IPV6 level socket
options.
Reported by: syzbot+66ede232c3d1271c6...@syzkaller.appspotmail.com
MFC after: 3 days
---
sys/netinet/sctp_os_bsd.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sys/netinet/sctp_os_bsd.h b/sys/netinet/sctp_os_bsd.h
index e8d08588fbfb..faca8a3b6276 100644
--- a/sys/netinet/sctp_os_bsd.h
+++ b/sys/netinet/sctp_os_bsd.h
@@ -428,9 +428,11 @@ typedef struct route sctp_route_t;
\
m_clrprotoflags(o_pak); \
if (local_inp != NULL) { \
+ INP_RLOCK(&local_inp->ip_inp.inp); \
result = ip6_output(o_pak, \
local_inp->ip_inp.inp.in6p_outputopts, \
(ro), 0, 0, ifp, NULL); \
+ INP_RUNLOCK(&local_inp->ip_inp.inp); \
} else { \
result = ip6_output(o_pak, NULL, (ro), 0, 0, ifp, NULL); \
} \
