kernel - Fix ENOBUFS related panic in tcp_output

* If the tcp_output code gets all the way to the end but then has to
  'goto again', it fails to NULL out the (th) pointer.  If the mbuf fails
  on the retry (m == NULL), the non-NULL (th) winds up causing the code to
  believe that the mbuf is good and results in a null-pointer dereference.

diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index 2bdda66..ccde9af 100644 (file)
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -1117,8 +1117,10 @@ out:
        tp->t_flags &= ~TF_ACKNOW;
        if (tcp_delack_enabled)
                tcp_callout_stop(tp, tp->tt_delack);
-       if (sendalot)
+       if (sendalot) {
+               th = NULL;
                goto again;
+       }
        return (0);
 }