In tcp_hc_insert() we may have the case where we have hit the global

cache size limit but this bucket row is empty.  Normally we want to
recycle the oldest entry in the bucket row.  If there isn't any the
TAILQ_REMOVE leads to a panic by trying to remove a non-existing
element.  Fix this by just returning NULL and failing the insert.
This is not a problem as the TCP hostache is only advisory.

Submitted by:	jhb

1 files changed, 6 insertions, 0 deletions

diff --git a/sys/netinet/tcp_hostcache.c b/sys/netinet/tcp_hostcache.c
index 7707237..e335000 100644
--- a/sys/netinet/tcp_hostcache.c
+++ b/sys/netinet/tcp_hostcache.c
@@ -351,7 +351,13 @@ tcp_hc_insert(struct in_conninfo *inc)
 		 * efficient.  Instead just reuse the least used element.
 		 * We may drop something that is still "in-use" but we can be
 		 * "lossy".
+		 * Just give up if this bucket row is empty and we don't have
+		 * anything to replace.
 		 */
+		if (hc_entry == NULL) {
+			THC_UNLOCK(&hc_head->hch_mtx);
+			return NULL;
+		}
 		TAILQ_REMOVE(&hc_head->hch_bucket, hc_entry, rmx_q);
 		tcp_hostcache.hashbase[hash].hch_length--;
 		tcp_hostcache.cache_count--;