From 313ce0df5b13f494f88a3e5511e4f65a3af68d81 Mon Sep 17 00:00:00 2001 From: rwatson Date: Tue, 24 Feb 2009 11:17:50 +0000 Subject: [PATCH] In tcp_usr_shutdown() and tcp_usr_send(), I missed converting NULL checks for the tcpcb, previously used to detect complete disconnection, with INP_DROPPED checks. Correct that, preventing shutdown() from improperly generating a TCP segment with destination IP and port of 0.0.0.0:0. PR: kern/132050 Reported by: david gueluy MFC after: 3 weeks --- sys/netinet/tcp_usrreq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c index 89987c4c7e42..05e22bea0c90 100644 --- a/sys/netinet/tcp_usrreq.c +++ b/sys/netinet/tcp_usrreq.c @@ -695,7 +695,8 @@ tcp_usr_shutdown(struct socket *so) TCPDEBUG1(); socantsendmore(so); tcp_usrclosed(tp); - error = tcp_output_disconnect(tp); + if (!(inp->inp_vflag & INP_DROPPED)) + error = tcp_output_disconnect(tp); out: TCPDEBUG2(PRU_SHUTDOWN); @@ -828,7 +829,7 @@ tcp_usr_send(struct socket *so, int flags, struct mbuf *m, INP_INFO_WUNLOCK(&V_tcbinfo); headlocked = 0; } - if (tp != NULL) { + if (!(inp->inp_vflag & INP_DROPPED)) { if (flags & PRUS_MORETOCOME) tp->t_flags |= TF_MORETOCOME; error = tcp_output_send(tp);