Simplifly syncache_expand() and clarify its semantics. Zero is returned

when the ACK is invalid and doesn't belong to any registered connection,
either in syncache or through SYN cookies.  True but a NULL struct socket
is returned when the 3WHS completed but the socket could not be created
due to insufficient resources or limits reached.

For both cases an RST is sent back in tcp_input().

A logic error leading to a panic is fixed where syncache_expand() would
free the mbuf on socket allocation failure but tcp_input() later supplies
it to tcp_dropwithreset() to issue a RST to the peer.

Reported by:	kris (the panic)

1 files changed, 8 insertions, 8 deletions

diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index e6022b4..bf8df6a 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -832,22 +832,22 @@ findpcb:
 				tcp_dooptions(&to, optp, optlen, 0);
 				if (!syncache_expand(&inc, &to, th, &so, m)) {
 					/*
-					 * No syncache entry, or ACK was not
+					 * No syncache entry or ACK was not
 					 * for our SYN/ACK.  Send a RST.
 					 */
-					tcpstat.tcps_badsyn++;
 					rstreason = BANDLIM_RST_OPENPORT;
 					goto dropwithreset;
 				}
 				if (so == NULL) {
 					/*
-					 * Could not complete 3-way handshake,
-					 * connection is being closed down, and
-					 * syncache has free'd mbuf.
+					 * We completed the 3-way handshake
+					 * but could not allocate a socket
+					 * either due to memory shortage,
+					 * listen queue length limits or
+					 * global socket limits.
 					 */
-					INP_UNLOCK(inp);
-					INP_INFO_WUNLOCK(&tcbinfo);
-					return;
+					rstreason = BANDLIM_UNLIMITED;
+					goto dropwithreset;
 				}
 				/*
 				 * Socket is created in state SYN_RECEIVED.