svn commit: r364376 - stable/12/sys/netinet

[Richard Scheffenegger]

Author: rscheff
Date: Wed Aug 19 10:32:26 2020
New Revision: 364376
URL: https://svnweb.freebsd.org/changeset/base/364376

Log:
  MFC r362988: Fix KASSERT during tcp_newtcpcb when low on memory
  
  While testing with system default cc set to cubic, and
  running a memory exhaustion validation, FreeBSD panics for a
  missing inpcb reference / lock.
  
  Reviewed by:	rgrimes (mentor), tuexen (mentor)
  Sponsored by:	NetApp, Inc.
  Differential Revision:	https://reviews.freebsd.org/D25583

Modified:
  stable/12/sys/netinet/tcp_subr.c
Directory Properties:
  stable/12/   (props changed)

Modified: stable/12/sys/netinet/tcp_subr.c
==============================================================================
--- stable/12/sys/netinet/tcp_subr.c	Wed Aug 19 10:01:05 2020	(r364375)
+++ stable/12/sys/netinet/tcp_subr.c	Wed Aug 19 10:32:26 2020	(r364376)
@@ -1615,6 +1615,12 @@ tcp_newtcpcb(struct inpcb *inp)
 	KASSERT(!STAILQ_EMPTY(&cc_list), ("cc_list is empty!"));
 	CC_ALGO(tp) = CC_DEFAULT();
 	CC_LIST_RUNLOCK();
+	/*
+	 * The tcpcb will hold a reference on its inpcb until tcp_discardcb()
+	 * is called.
+	 */
+	in_pcbref(inp);	/* Reference for tcpcb */
+	tp->t_inpcb = inp;
 
 	if (CC_ALGO(tp)->cb_init != NULL)
 		if (CC_ALGO(tp)->cb_init(tp->ccv) > 0) {
@@ -1659,12 +1665,6 @@ tcp_newtcpcb(struct inpcb *inp)
 	if (V_tcp_do_sack)
 		tp->t_flags |= TF_SACK_PERMIT;
 	TAILQ_INIT(&tp->snd_holes);
-	/*
-	 * The tcpcb will hold a reference on its inpcb until tcp_discardcb()
-	 * is called.
-	 */
-	in_pcbref(inp);	/* Reference for tcpcb */
-	tp->t_inpcb = inp;
 
 	/*
 	 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no