git: 9c67d6ed9632 - main - inpcb: inp_next() never returns a freed inpcb

From: Gleb Smirnoff <glebius_at_FreeBSD.org>
Date: Thu, 22 Oct 2026 03:31:29 UTC
The branch main has been updated by glebius:

URL: https://cgit.FreeBSD.org/src/commit/?id=9c67d6ed9632e180e95bebabc5a8ceae7f22ce1a

commit 9c67d6ed9632e180e95bebabc5a8ceae7f22ce1a
Author:     Gleb Smirnoff <glebius@FreeBSD.org>
AuthorDate: 2026-10-21 21:36:01 +0000
Commit:     Gleb Smirnoff <glebius@FreeBSD.org>
CommitDate: 2026-10-22 03:29:46 +0000

    inpcb: inp_next() never returns a freed inpcb
---
 sys/netinet6/in6_pcb.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/sys/netinet6/in6_pcb.c b/sys/netinet6/in6_pcb.c
index 6e30ec15faff..05c04be5dd80 100644
--- a/sys/netinet6/in6_pcb.c
+++ b/sys/netinet6/in6_pcb.c
@@ -733,13 +733,11 @@ in6_pcbnotify(struct inpcbinfo *pcbinfo, struct sockaddr_in6 *sa6_dst,
 		 * as usual.
 		 */
 		if (lport == 0 && fport == 0 && flowinfo &&
-		    inp->inp_socket != NULL &&
 		    flowinfo == (inp->inp_flow & IPV6_FLOWLABEL_MASK) &&
 		    IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, &sa6_src.sin6_addr))
 			goto do_notify;
 		else if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr,
 					     &sa6_dst->sin6_addr) ||
-			 inp->inp_socket == 0 ||
 			 (lport && inp->inp_lport != lport) ||
 			 (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) &&
 			  !IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,