git: 6a97a237a258 - stable/12 - MFC 85d8d30f9f70: Don't allow allocating a new send tag on an INP which is being torn down. This fixes a potential send tag leak.

[Hans Petter Selasky]

The branch stable/12 has been updated by hselasky:

URL: https://cgit.FreeBSD.org/src/commit/?id=6a97a237a25832395182076acc1f1dd23fca9818

commit 6a97a237a25832395182076acc1f1dd23fca9818
Author:     Hans Petter Selasky <hselasky at FreeBSD.org>
AuthorDate: 2021-01-26 14:01:38 +0000
Commit:     Hans Petter Selasky <hselasky at FreeBSD.org>
CommitDate: 2021-02-08 08:42:19 +0000

    MFC 85d8d30f9f70:
    Don't allow allocating a new send tag on an INP which is being torn down.
    This fixes a potential send tag leak.
    
    Reviewed by:    rrs@
    Sponsored by:   Mellanox Technologies // NVIDIA Networking
    
    (cherry picked from commit 85d8d30f9f7046f5e89295352ded49135b25fbe3)
---
 sys/netinet/in_pcb.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index 56920d3e973a..b8f06a96fe27 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -3323,7 +3323,12 @@ in_pcbattach_txrtlmt(struct inpcb *inp, struct ifnet *ifp,
 
 	INP_WLOCK_ASSERT(inp);
 
-	if (inp->inp_snd_tag != NULL)
+	/*
+	 * If there is already a send tag, or the INP is being torn
+	 * down, allocating a new send tag is not allowed. Else send
+	 * tags may leak.
+	 */
+	if (inp->inp_snd_tag != NULL || (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) != 0)
 		return (EINVAL);
 
 	if (ifp->if_snd_tag_alloc == NULL) {