From 7ff0b850a68a0c900c704acdaa6d4c47ffd35e63 Mon Sep 17 00:00:00 2001
From: Andre Oppermann <andre@FreeBSD.org>
Date: Sun, 17 Sep 2006 13:39:35 +0000
Subject: [PATCH] Make tcp_usr_send() free the passed mbufs on error in all
 cases as the comment to it claims.

Sponsored by:	TCP/IP Optimization Fundraise 2005
---
 sys/netinet/tcp_usrreq.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c
index 549627bf799..fb61602b2d8 100644
--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -800,6 +800,10 @@ tcp_usr_send(struct socket *so, int flags, struct mbuf *m,
 	KASSERT(inp != NULL, ("tcp_usr_send: inp == NULL"));
 	INP_LOCK(inp);
 	if (inp->inp_vflag & (INP_TIMEWAIT | INP_DROPPED)) {
+		if (control)
+			m_freem(control);
+		if (m)
+			m_freem(m);
 		error = EINVAL;
 		goto out;
 	}