X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/4bd07ac2140668789aa3ee8ec4dde4a3e0a3bba5..d190cdc3f5544636abb56dc1874be391d3e1b148:/bsd/netinet6/in6_pcb.c

diff --git a/bsd/netinet6/in6_pcb.c b/bsd/netinet6/in6_pcb.c
index 35888ba18..54b9555f6 100644
--- a/bsd/netinet6/in6_pcb.c
+++ b/bsd/netinet6/in6_pcb.c
@@ -657,19 +657,28 @@ in6_pcbdetach(struct inpcb *inp)
 		}
 		im6o = inp->in6p_moptions;
 		inp->in6p_moptions = NULL;
-		if (im6o != NULL)
-			IM6O_REMREF(im6o);
 
 		imo = inp->inp_moptions;
 		inp->inp_moptions = NULL;
-		if (imo != NULL)
-			IMO_REMREF(imo);
+
 		sofreelastref(so, 0);
 		inp->inp_state = INPCB_STATE_DEAD;
 		/* makes sure we're not called twice from so_close */
 		so->so_flags |= SOF_PCBCLEARING;
  
 		inpcb_gc_sched(inp->inp_pcbinfo, INPCB_TIMER_FAST);
+
+		/*
+		 * See inp_join_group() for why we need to unlock
+		 */
+		if (im6o != NULL || imo != NULL) {
+			socket_unlock(so, 0);
+			if (im6o != NULL)
+				IM6O_REMREF(im6o);
+			if (imo != NULL)
+				IMO_REMREF(imo);
+			socket_lock(so, 0);
+		}
 	}
 }