git: ac86c042fbce - stable/13 - MFC 85d8d30f9f70: Don't allow allocating a new send tag on an INP which is being torn down. This fixes a potential send tag leak.

[Hans Petter Selasky]

The branch stable/13 has been updated by hselasky:

URL: https://cgit.FreeBSD.org/src/commit/?id=ac86c042fbced7f210cb0627525832774d0a9b88

commit ac86c042fbced7f210cb0627525832774d0a9b88
Author:     Hans Petter Selasky <hselasky at FreeBSD.org>
AuthorDate: 2021-01-26 14:01:38 +0000
Commit:     Hans Petter Selasky <hselasky at FreeBSD.org>
CommitDate: 2021-02-08 08:32:48 +0000

    MFC 85d8d30f9f70:
    Don't allow allocating a new send tag on an INP which is being torn down.
    This fixes a potential send tag leak.
    
    Reviewed by:    rrs@
    Sponsored by:   Mellanox Technologies // NVIDIA Networking
    
    (cherry picked from commit 85d8d30f9f7046f5e89295352ded49135b25fbe3)
---
 sys/netinet/in_pcb.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index 5adac0fddddf..8232003b3808 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -3399,7 +3399,12 @@ in_pcbattach_txrtlmt(struct inpcb *inp, struct ifnet *ifp,
 
 	INP_WLOCK_ASSERT(inp);
 
-	if (*st != NULL)
+	/*
+	 * If there is already a send tag, or the INP is being torn
+	 * down, allocating a new send tag is not allowed. Else send
+	 * tags may leak.
+	 */
+	if (*st != NULL || (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) != 0)
 		return (EINVAL);
 
 	error = m_snd_tag_alloc(ifp, &params, st);