Correctly handle the case where an inp has already been dropped by the time

the TOE driver reports that an active open failed.  toe_connect_failed is
supposed to handle this but it should be provided the inpcb instead of the
tcpcb which may no longer be around.

2 files changed, 7 insertions, 5 deletions

diff --git a/sys/netinet/toecore.c b/sys/netinet/toecore.c
index 4b4efb7..7e498dd 100644
--- a/sys/netinet/toecore.c
+++ b/sys/netinet/toecore.c
@@ -478,15 +478,17 @@ toe_l2_resolve(struct toedev *tod, struct ifnet *ifp, struct sockaddr *sa,
 }
 
 void
-toe_connect_failed(struct toedev *tod, struct tcpcb *tp, int err)
+toe_connect_failed(struct toedev *tod, struct inpcb *inp, int err)
 {
-	struct inpcb *inp = tp->t_inpcb;
 
 	INP_WLOCK_ASSERT(inp);
-	KASSERT(tp->t_flags & TF_TOE,
-	    ("%s: tp %p not offloaded.", __func__, tp));
 
 	if (!(inp->inp_flags & INP_DROPPED)) {
+		struct tcpcb *tp = intotcpcb(inp);
+
+		KASSERT(tp->t_flags & TF_TOE,
+		    ("%s: tp %p not offloaded.", __func__, tp));
+
 		if (err == EAGAIN) {
 
 			/*
diff --git a/sys/netinet/toecore.h b/sys/netinet/toecore.h
index a381825..6ea9851 100644
--- a/sys/netinet/toecore.h
+++ b/sys/netinet/toecore.h
@@ -119,7 +119,7 @@ int unregister_toedev(struct toedev *);
 int toe_l2_resolve(struct toedev *, struct ifnet *, struct sockaddr *,
     uint8_t *, uint16_t *);
 
-void toe_connect_failed(struct toedev *, struct tcpcb *, int);
+void toe_connect_failed(struct toedev *, struct inpcb *, int);
 
 void toe_syncache_add(struct in_conninfo *, struct tcpopt *, struct tcphdr *,
     struct inpcb *, void *, void *);