[SCTP]: Unhash the endpoint in sctp_endpoint_free().

This prevents a race between the close of a socket and receive of an
incoming packet.

Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 67bd53070ee0b31d0babb2221ccd57e03f81124b..ffda1d680529c4cb4c9fc6b7a478097e44983f54 100644 (file)
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -158,6 +158,12 @@ void sctp_endpoint_add_asoc(struct sctp_endpoint *ep,
 void sctp_endpoint_free(struct sctp_endpoint *ep)
 {
        ep->base.dead = 1;
+
+       ep->base.sk->sk_state = SCTP_SS_CLOSED;
+
+       /* Unlink this endpoint, so we can't find it again! */
+       sctp_unhash_endpoint(ep);
+
        sctp_endpoint_put(ep);
 }
 
@@ -166,11 +172,6 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep)
 {
        SCTP_ASSERT(ep->base.dead, "Endpoint is not dead", return);
 
-       ep->base.sk->sk_state = SCTP_SS_CLOSED;
-
-       /* Unlink this endpoint, so we can't find it again! */
-       sctp_unhash_endpoint(ep);
-
        /* Free up the HMAC transform. */
        sctp_crypto_free_tfm(sctp_sk(ep->base.sk)->hmac);