12976 system panics with error in IP module
Reviewed by: Andy Fiddaman <andy@omniosce.org>
Reviewed by: Paul Winder <p.winder@me.com>

@@ -20,11 +20,11 @@
  */
 
 /*
  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2014, 2017 by Delphix. All rights reserved.
- * Copyright 2019 Joyent, Inc.
+ * Copyright 2020 Joyent, Inc.
  */
 
 /* This file contains all TCP output processing functions. */
 
 #include <sys/types.h>

@@ -1675,15 +1675,27 @@
                 connp->conn_rq = NULL;
                 connp->conn_wq = NULL;
 
                 /* non-STREAM socket, release the upper handle */
                 if (IPCL_IS_NONSTR(connp)) {
-                        ASSERT(connp->conn_upper_handle != NULL);
-                        (*connp->conn_upcalls->su_closed)
-                            (connp->conn_upper_handle);
+                        sock_upcalls_t *upcalls = connp->conn_upcalls;
+                        sock_upper_handle_t handle = connp->conn_upper_handle;
+
+                        ASSERT(upcalls != NULL);
+                        ASSERT(upcalls->su_closed != NULL);
+                        ASSERT(handle != NULL);
+                        /*
+                         * Set these to NULL first because closed() will free
+                         * upper structures.  Acquire conn_lock because an
+                         * external caller like conn_get_socket_info() will
+                         * upcall if these are non-NULL.
+                         */
+                        mutex_enter(&connp->conn_lock);
                         connp->conn_upper_handle = NULL;
                         connp->conn_upcalls = NULL;
+                        mutex_exit(&connp->conn_lock);
+                        upcalls->su_closed(handle);
                 }
         }
 
         /* Signal tcp_close() to finish closing. */
         mutex_enter(&tcp->tcp_closelock);