`so_state' and `so_rcv' need to be checked atomically, so extend the scope of the lock.
ok? Index: kern/sys_socket.c =================================================================== RCS file: /cvs/src/sys/kern/sys_socket.c,v retrieving revision 1.30 diff -u -p -r1.30 sys_socket.c --- kern/sys_socket.c 22 Feb 2017 10:20:21 -0000 1.30 +++ kern/sys_socket.c 18 Jul 2017 06:41:10 -0000 @@ -180,14 +180,13 @@ soo_stat(struct file *fp, struct stat *u memset(ub, 0, sizeof (*ub)); ub->st_mode = S_IFSOCK; - if ((so->so_state & SS_CANTRCVMORE) == 0 || - so->so_rcv.sb_cc != 0) + s = solock(so); + if ((so->so_state & SS_CANTRCVMORE) == 0 || so->so_rcv.sb_cc != 0) ub->st_mode |= S_IRUSR | S_IRGRP | S_IROTH; if ((so->so_state & SS_CANTSENDMORE) == 0) ub->st_mode |= S_IWUSR | S_IWGRP | S_IWOTH; ub->st_uid = so->so_euid; ub->st_gid = so->so_egid; - s = solock(so); (void) ((*so->so_proto->pr_usrreq)(so, PRU_SENSE, (struct mbuf *)ub, NULL, NULL, p)); sounlock(s);