6732854 panic: assertion failed: (connp->conn_fanout != 0L && connp->conn_ref >= 4) ...

2 files changed, 11 insertions, 12 deletions

diff --git a/usr/src/uts/common/inet/tcp.h b/usr/src/uts/common/inet/tcp.h
index e891ccca97..1a45712d2c 100644
--- a/usr/src/uts/common/inet/tcp.h
+++ b/usr/src/uts/common/inet/tcp.h
@@ -249,33 +249,32 @@ typedef struct tcp_s {
 		tcp_unbind_pending : 1, /* Client sent T_UNBIND_REQ */
 		tcp_deferred_clean_death : 1,
 					/* defer tcp endpoint cleanup etc. */
-		tcp_conn_def_q0: 1,	/* move from q0 to q deferred */
-
 		tcp_ka_enabled: 1,	/* Connection KeepAlive Timer needed */
+
 		tcp_zero_win_probe: 1,	/* Zero win probing is in progress */
 		tcp_loopback: 1,	/* src and dst are the same machine */
 		tcp_localnet: 1,	/* src and dst are on the same subnet */
-
 		tcp_syn_defense: 1,	/* For defense against SYN attack */
 #define	tcp_dontdrop	tcp_syn_defense
+
 		tcp_set_timer : 1,
 		tcp_active_open: 1,	/* This is a active open */
 		tcp_timeout : 1,	/* qbufcall failed, qtimeout pending */
-
 		tcp_rexmit : 1,		/* TCP is retransmitting */
+
 		tcp_snd_sack_ok : 1,	/* Can use SACK for this connection */
 		tcp_empty_flag : 1,	/* Empty flag for future use */
 		tcp_recvdstaddr : 1,	/* return T_EXTCONN_IND with dst addr */
-
 		tcp_hwcksum : 1,	/* The NIC is capable of hwcksum */
+
 		tcp_ip_forward_progress : 1,
 		tcp_anon_priv_bind : 1,
 		tcp_ecn_ok : 1,		/* Can use ECN for this connection */
-
 		tcp_ecn_echo_on : 1,	/* Need to do ECN echo */
+
 		tcp_ecn_cwr_sent : 1,	/* ECN_CWR has been sent */
 		tcp_cwr : 1,		/* Cwnd has reduced recently */
-		tcp_pad_to_bit31 : 1;
+		tcp_pad_to_bit31 : 2;
 	/* Following manipulated by TCP under squeue protection */
 	uint32_t
 		tcp_mdt : 1,		/* Lower layer is capable of MDT */
@@ -373,6 +372,8 @@ typedef struct tcp_s {
 	struct tcp_s *tcp_eager_next_q0; /* next eager in SYN_RCVD state */
 	struct tcp_s *tcp_eager_prev_q0; /* prev eager in SYN_RCVD state */
 					/* all eagers form a circular list */
+	boolean_t tcp_conn_def_q0;	/* move from q0 to q deferred */
+
 	union {
 	    mblk_t *tcp_eager_conn_ind; /* T_CONN_IND waiting for 3rd ack. */
 	    mblk_t *tcp_opts_conn_req; /* T_CONN_REQ w/ options processed */
diff --git a/usr/src/uts/common/inet/tcp/tcp.c b/usr/src/uts/common/inet/tcp/tcp.c
index 50046053b0..d7b568e98c 100644
--- a/usr/src/uts/common/inet/tcp/tcp.c
+++ b/usr/src/uts/common/inet/tcp/tcp.c
@@ -18230,6 +18230,8 @@ tcp_accept_finish(void *arg, mblk_t *mp, void *arg2)
 	 */
 	CONN_DEC_REF(tcp->tcp_saved_listener->tcp_connp);
 
+	tcp->tcp_detached = B_FALSE;
+
 	if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_accept_error) {
 		/*
 		 * Someone blewoff the eager before we could finish
@@ -18279,7 +18281,6 @@ tcp_accept_finish(void *arg, mblk_t *mp, void *arg2)
 			tcp->tcp_hard_binding = B_FALSE;
 			tcp->tcp_hard_bound = B_TRUE;
 		}
-		tcp->tcp_detached = B_FALSE;
 		return;
 	}
 
@@ -18816,11 +18817,8 @@ no_more_eagers:
 		 * but we still have an extra refs on eager (apart from the
 		 * usual tcp references). The ref was placed in tcp_rput_data
 		 * before sending the conn_ind in tcp_send_conn_ind.
-		 * The ref will be dropped in tcp_accept_finish(). As sockfs
-		 * has already established this tcp with it's own stream,
-		 * it's OK to set tcp_detached to B_FALSE.
+		 * The ref will be dropped in tcp_accept_finish().
 		 */
-		econnp->conn_tcp->tcp_detached = B_FALSE;
 		squeue_enter_nodrain(econnp->conn_sqp, opt_mp,
 		    tcp_accept_finish, econnp, SQTAG_TCP_ACCEPT_FINISH_Q0);
 		return;