re: kern/44742: Remotely triggerable ECN panic in tcp_output() on current

[matthew green <mrg%eterna.com.au@localhost>]

please try this patch.  i noticed all other uses of
tp->t_inpcb assume it may be NULL.


Index: tcp_output.c
===================================================================
RCS file: /cvsroot/src/sys/netinet/tcp_output.c,v
retrieving revision 1.169
diff -p -r1.169 tcp_output.c
*** tcp_output.c        26 Jan 2010 18:09:08 -0000      1.169
--- tcp_output.c        21 Mar 2011 19:47:02 -0000
*************** send:
*** 1347,1358 ****
                        switch (af) {
  #ifdef INET
                        case AF_INET:
!                               tp->t_inpcb->inp_ip.ip_tos |= IPTOS_ECN_ECT0;
                                break;
  #endif
  #ifdef INET6
                        case AF_INET6:
!                               ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20);
                                break;
  #endif
                        }
--- 1347,1362 ----
                        switch (af) {
  #ifdef INET
                        case AF_INET:
!                               if (tp->t_inpcb)
!                                       tp->t_inpcb->inp_ip.ip_tos |=
!                                           IPTOS_ECN_ECT0;
                                break;
  #endif
  #ifdef INET6
                        case AF_INET6:
!                               if (ip6)
!                                       ip6->ip6_flow |=
!                                           htonl(IPTOS_ECN_ECT0 << 20);
                                break;
  #endif
                        }