svn commit: r335749 - head/sys/netinet

[Gleb Smirnoff]

Author: glebius
Date: Wed Jun 27 22:01:59 2018
New Revision: 335749
URL: https://svnweb.freebsd.org/changeset/base/335749

Log:
  Check the inp_flags under inp lock. Looks like the race was hidden
  before, the conversion of tcbinfo to CK_LIST have uncovered it.

Modified:
  head/sys/netinet/tcp_subr.c

Modified: head/sys/netinet/tcp_subr.c
==============================================================================
--- head/sys/netinet/tcp_subr.c	Wed Jun 27 22:00:50 2018	(r335748)
+++ head/sys/netinet/tcp_subr.c	Wed Jun 27 22:01:59 2018	(r335749)
@@ -2019,9 +2019,11 @@ tcp_drain(void)
 	 */
 		INP_INFO_WLOCK(&V_tcbinfo);
 		CK_LIST_FOREACH(inpb, V_tcbinfo.ipi_listhead, inp_list) {
-			if (inpb->inp_flags & INP_TIMEWAIT)
-				continue;
 			INP_WLOCK(inpb);
+			if (inpb->inp_flags & INP_TIMEWAIT) {
+				INP_WUNLOCK(inpb);
+				continue;
+			}
 			if ((tcpb = intotcpcb(inpb)) != NULL) {
 				tcp_reass_flush(tcpb);
 				tcp_clean_sackreport(tcpb);