From 303939942c22338c4661a56dd0fae27a6aaccde6 Mon Sep 17 00:00:00 2001
From: Robert Watson <rwatson@FreeBSD.org>
Date: Wed, 1 Jun 2005 12:14:56 +0000
Subject: [PATCH] When aborting tcp_attach() due to a problem allocating or
 attaching the tcpcb, lock the inpcb before calling in_pcbdetach() or
 in6_pcbdetach(), as they expect the inpcb to be passed locked.

MFC after:	7 days
---
 sys/netinet/tcp_usrreq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c
index ccdc807a8a0c..653ab6c3ffc7 100644
--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -1211,6 +1211,8 @@ tcp_attach(so)
 		int nofd = so->so_state & SS_NOFDREF;	/* XXX */
 
 		so->so_state &= ~SS_NOFDREF;	/* don't free the socket yet */
+
+		INP_LOCK(inp);
 #ifdef INET6
 		if (isipv6)
 			in6_pcbdetach(inp);