Fix refcounting for sockets when stcb/inp kill timer fires.
Thanks to Anatoly Korniltsev for reporting issue
@@ -2117,14 +2117,13 @@ sctp_timeout_handler(void *t)
SCTP_SOCKET_UNLOCK(SCTP_INP_SO(inp), 1);
#endif
inp = NULL;
- goto out_no_decr;
+ goto out_decr;
case SCTP_TIMER_TYPE_ASOCKILL:
KASSERT(inp != NULL && stcb != NULL && net == NULL,
("timeout of type %d: inp = %p, stcb = %p, net = %p",
type, inp, stcb, net));
SCTP_STAT_INCR(sctps_timoassockill);
/* Can we free it yet? */
- SCTP_INP_DECR_REF(inp);
sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
#if defined(__APPLE__) && !defined(__Userspace__)
@@ -2145,7 +2144,7 @@ sctp_timeout_handler(void *t)
* duplicate unlock or unlock of a free mtx :-0
*/
stcb = NULL;
- goto out_no_decr;
+ goto out_decr;
case SCTP_TIMER_TYPE_ADDR_WQ:
KASSERT(inp == NULL && stcb == NULL && net == NULL,
("timeout of type %d: inp = %p, stcb = %p, net = %p",
@@ -2214,7 +2213,6 @@ out_decr:
if (net != NULL) {
sctp_free_remote_addr(net);
}
-out_no_decr:
SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d handler finished.\n", type);
#if defined(__FreeBSD__) && !defined(__Userspace__)
CURVNET_RESTORE();
