git: 85d8d30f9f70 - main - Don't allow allocating a new send tag on an INP which is being torn down. This fixes a potential send tag leak.

[Hans Petter Selasky]

The branch main has been updated by hselasky:

URL: https://cgit.FreeBSD.org/src/commit/?id=85d8d30f9f7046f5e89295352ded49135b25fbe3

commit 85d8d30f9f7046f5e89295352ded49135b25fbe3
Author:     Hans Petter Selasky <hselasky at FreeBSD.org>
AuthorDate: 2021-01-26 14:01:38 +0000
Commit:     Hans Petter Selasky <hselasky at FreeBSD.org>
CommitDate: 2021-01-26 17:00:02 +0000

    Don't allow allocating a new send tag on an INP which is being torn down.
    This fixes a potential send tag leak.
    
    Reviewed by:    rrs@
    MFC after:      1 week
    Sponsored by:   Mellanox Technologies // NVIDIA Networking
---
 sys/netinet/in_pcb.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index 5adac0fddddf..8232003b3808 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -3399,7 +3399,12 @@ in_pcbattach_txrtlmt(struct inpcb *inp, struct ifnet *ifp,
 
 	INP_WLOCK_ASSERT(inp);
 
-	if (*st != NULL)
+	/*
+	 * If there is already a send tag, or the INP is being torn
+	 * down, allocating a new send tag is not allowed. Else send
+	 * tags may leak.
+	 */
+	if (*st != NULL || (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) != 0)
 		return (EINVAL);
 
 	error = m_snd_tag_alloc(ifp, &params, st);