Acquire the socket buffer lock when calling unp_scan() on

so->so_rcv.sb_mb to prevent the mbuf chain from changing during the
scan.

1 files changed, 2 insertions, 0 deletions

diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
index 95e4874..2a992bf 100644
--- a/sys/kern/uipc_usrreq.c
+++ b/sys/kern/uipc_usrreq.c
@@ -1492,7 +1492,9 @@ unp_gc()
 			 * message buffers. Follow those links and mark them
 			 * as accessible too.
 			 */
+			SOCKBUF_LOCK(&so->so_rcv);
 			unp_scan(so->so_rcv.sb_mb, unp_mark);
+			SOCKBUF_UNLOCK(&so->so_rcv);
 		}
 	} while (unp_defer);
 	sx_sunlock(&filelist_lock);