Locking bug in sys_accept()

[Matthew Dempsky]

Noticed by sthen@ using my strict locking diff.

ok?


Index: uipc_syscalls.c
===================================================================
RCS file: /cvs/src/sys/kern/uipc_syscalls.c,v
retrieving revision 1.76
diff -u -p -r1.76 uipc_syscalls.c
--- uipc_syscalls.c     3 Jul 2010 04:44:51 -0000       1.76
+++ uipc_syscalls.c     22 Sep 2010 00:37:27 -0000
@@ -213,7 +213,7 @@ sys_accept(struct proc *p, void *v, regi
                 */
                soqinsque(head, so, 1);
                wakeup_one(&head->so_timeo);
-               goto bad;
+               goto unlock;
        }
        *retval = tmpfd;
 
@@ -243,8 +243,9 @@ sys_accept(struct proc *p, void *v, regi
                FILE_SET_MATURE(fp);
        }
        m_freem(nam);
-bad:
+unlock:
        fdpunlock(p->p_fd);
+bad:
        splx(s);
        FRELE(headfp);
        return (error);