svn commit: r362846 - head/sys/netinet/tcp_stacks

[Michael Tuexen]

Author: tuexen
Date: Wed Jul  1 17:17:06 2020
New Revision: 362846
URL: https://svnweb.freebsd.org/changeset/base/362846

Log:
  Fix the cleanup handling in a error path for TCP BBR.
  
  Reported by:		syzbot+df7899c55c4cc52f5447 at syzkaller.appspotmail.com
  Reviewed by:		rscheff
  Sponsored by:		Netflix, Inc.
  Differential Revision:	https://reviews.freebsd.org/D25486

Modified:
  head/sys/netinet/tcp_stacks/bbr.c

Modified: head/sys/netinet/tcp_stacks/bbr.c
==============================================================================
--- head/sys/netinet/tcp_stacks/bbr.c	Wed Jul  1 16:57:57 2020	(r362845)
+++ head/sys/netinet/tcp_stacks/bbr.c	Wed Jul  1 17:17:06 2020	(r362846)
@@ -13381,6 +13381,8 @@ send:
 					 */
 					BBR_STAT_INC(bbr_offset_drop);
 					tcp_set_inp_to_drop(inp, EFAULT);
+					SOCKBUF_UNLOCK(sb);
+					(void)m_free(m);
 					return (0);
 				}
 				len = rsm->r_end - rsm->r_start;