diff options
| author | np <np@FreeBSD.org> | 2012-11-06 20:22:39 +0000 |
|---|---|---|
| committer | np <np@FreeBSD.org> | 2012-11-06 20:22:39 +0000 |
| commit | b20d377b835f96886320a8500012a1fe22ce02d4 (patch) | |
| tree | f3c67a3aa3a739edc306799af79534c69b90788e | |
| parent | 0b6373844a5af006f252218a8d7ebebe1a32cffd (diff) | |
| download | FreeBSD-src-b20d377b835f96886320a8500012a1fe22ce02d4.zip FreeBSD-src-b20d377b835f96886320a8500012a1fe22ce02d4.tar.gz | |
Make sure the inp hasn't been dropped before trying to access its socket
and tcpcb.
MFC after: 3 days
| -rw-r--r-- | sys/dev/cxgbe/tom/t4_cpl_io.c | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/sys/dev/cxgbe/tom/t4_cpl_io.c b/sys/dev/cxgbe/tom/t4_cpl_io.c index 28a0cec..e3f0296 100644 --- a/sys/dev/cxgbe/tom/t4_cpl_io.c +++ b/sys/dev/cxgbe/tom/t4_cpl_io.c @@ -982,7 +982,6 @@ do_abort_req(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m) struct sge_wrq *ofld_txq = toep->ofld_txq; struct inpcb *inp; struct tcpcb *tp; - struct socket *so; #ifdef INVARIANTS unsigned int opcode = G_CPL_OPCODE(be32toh(OPCODE_TID(cpl))); #endif @@ -1008,7 +1007,6 @@ do_abort_req(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m) INP_WLOCK(inp); tp = intotcpcb(inp); - so = inp->inp_socket; CTR6(KTR_CXGBE, "%s: tid %d (%s), toep_flags 0x%x, inp_flags 0x%x, status %d", @@ -1026,10 +1024,16 @@ do_abort_req(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m) } toep->flags |= TPF_ABORT_SHUTDOWN; - so_error_set(so, abort_status_to_errno(tp, cpl->status)); - tp = tcp_close(tp); - if (tp == NULL) - INP_WLOCK(inp); /* re-acquire */ + if ((inp->inp_flags & (INP_DROPPED | INP_TIMEWAIT)) == 0) { + struct socket *so = inp->inp_socket; + + if (so != NULL) + so_error_set(so, abort_status_to_errno(tp, + cpl->status)); + tp = tcp_close(tp); + if (tp == NULL) + INP_WLOCK(inp); /* re-acquire */ + } final_cpl_received(toep); done: |
