From e54b7cd007b5ae4850c551d21d97cb986fdb1c81 Mon Sep 17 00:00:00 2001
From: Michael Tuexen <tuexen@FreeBSD.org>
Date: Wed, 1 Jul 2020 17:17:06 +0000
Subject: [PATCH] Fix the cleanup handling in a error path for TCP BBR.

Reported by:		syzbot+df7899c55c4cc52f5447@syzkaller.appspotmail.com
Reviewed by:		rscheff
Sponsored by:		Netflix, Inc.
Differential Revision:	https://reviews.freebsd.org/D25486
---
 sys/netinet/tcp_stacks/bbr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/sys/netinet/tcp_stacks/bbr.c b/sys/netinet/tcp_stacks/bbr.c
index e8e558c76f99..196dd3c7086c 100644
--- a/sys/netinet/tcp_stacks/bbr.c
+++ b/sys/netinet/tcp_stacks/bbr.c
@@ -13381,6 +13381,8 @@ bbr_output_wtime(struct tcpcb *tp, const struct timeval *tv)
 					 */
 					BBR_STAT_INC(bbr_offset_drop);
 					tcp_set_inp_to_drop(inp, EFAULT);
+					SOCKBUF_UNLOCK(sb);
+					(void)m_free(m);
 					return (0);
 				}
 				len = rsm->r_end - rsm->r_start;