From 786bcc49fb2a66510465dd555f5da4a902efd5ad Mon Sep 17 00:00:00 2001
From: David Hill <dhill@cvs.openbsd.org>
Date: Wed, 1 Feb 2017 20:59:48 +0000
Subject: In sogetopt, preallocate an mbuf to avoid using sleeping mallocs with
 the netlock held.  This also changes the prototypes of the *ctloutput
 functions to take an mbuf instead of an mbuf pointer.

help, guidance from bluhm@ and mpi@
ok bluhm@
---
 sys/kern/uipc_socket.c    | 32 ++++++++++++++++++++-----------
 sys/net/rtsock.c          | 13 +++++--------
 sys/netinet/ip_mroute.c   | 31 +++++++++++++-----------------
 sys/netinet/ip_mroute.h   |  6 +++---
 sys/netinet/ip_output.c   | 31 +++++++++++-------------------
 sys/netinet/ip_var.h      |  8 ++++----
 sys/netinet/raw_ip.c      | 36 +++++++++++++++++------------------
 sys/netinet/tcp_usrreq.c  | 13 +++++--------
 sys/netinet/tcp_var.h     |  4 ++--
 sys/netinet6/icmp6.c      |  6 ++----
 sys/netinet6/ip6_mroute.c |  4 +---
 sys/netinet6/ip6_mroute.h |  4 ++--
 sys/netinet6/ip6_output.c | 48 +++++++++++++++++------------------------------
 sys/netinet6/ip6_var.h    | 10 +++++-----
 sys/netinet6/raw_ip6.c    | 29 ++++++++++++++--------------
 sys/sys/protosw.h         |  4 ++--
 16 files changed, 124 insertions(+), 155 deletions(-)

diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index 0c3171a8187..0619f25143e 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: uipc_socket.c,v 1.175 2017/01/27 20:31:42 bluhm Exp $	*/
+/*	$OpenBSD: uipc_socket.c,v 1.176 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: uipc_socket.c,v 1.21 1996/02/04 02:17:52 christos Exp $	*/
 
 /*
@@ -1560,7 +1560,7 @@ sosetopt(struct socket *so, int level, int optname, struct mbuf *m0)
 		if (so->so_proto && so->so_proto->pr_ctloutput) {
 			NET_LOCK(s);
 			error = (*so->so_proto->pr_ctloutput)(PRCO_SETOPT, so,
-			    level, optname, &m0);
+			    level, optname, m0);
 			NET_UNLOCK(s);
 			return (error);
 		}
@@ -1707,7 +1707,7 @@ sosetopt(struct socket *so, int level, int optname, struct mbuf *m0)
 				level = dom->dom_protosw->pr_protocol;
 				NET_LOCK(s);
 				error = (*so->so_proto->pr_ctloutput)
-				    (PRCO_SETOPT, so, level, optname, &m0);
+				    (PRCO_SETOPT, so, level, optname, m0);
 				NET_UNLOCK(s);
 				return (error);
 			}
@@ -1739,7 +1739,7 @@ sosetopt(struct socket *so, int level, int optname, struct mbuf *m0)
 		if (error == 0 && so->so_proto && so->so_proto->pr_ctloutput) {
 			NET_LOCK(s);
 			(*so->so_proto->pr_ctloutput)(PRCO_SETOPT, so,
-			    level, optname, &m0);
+			    level, optname, m0);
 			NET_UNLOCK(s);
 			m = NULL;	/* freed by protocol */
 		}
@@ -1758,11 +1758,19 @@ sogetopt(struct socket *so, int level, int optname, struct mbuf **mp)
 
 	if (level != SOL_SOCKET) {
 		if (so->so_proto && so->so_proto->pr_ctloutput) {
+			m = m_get(M_WAIT, MT_SOOPTS);
+			m->m_len = 0;
+
 			NET_LOCK(s);
 			error = (*so->so_proto->pr_ctloutput)(PRCO_GETOPT, so,
-			    level, optname, mp);
+			    level, optname, m);
 			NET_UNLOCK(s);
-			return (error);
+			if (error) {
+				m_free(m);
+				return (error);
+			}
+			*mp = m;
+			return (0);
 		} else
 			return (ENOPROTOOPT);
 	} else {
@@ -1835,7 +1843,6 @@ sogetopt(struct socket *so, int level, int optname, struct mbuf **mp)
 		    }
 
 		case SO_RTABLE:
-			(void)m_free(m);
 			if (so->so_proto && so->so_proto->pr_domain &&
 			    so->so_proto->pr_domain->dom_protosw &&
 			    so->so_proto->pr_ctloutput) {
@@ -1844,12 +1851,16 @@ sogetopt(struct socket *so, int level, int optname, struct mbuf **mp)
 				level = dom->dom_protosw->pr_protocol;
 				NET_LOCK(s);
 				error = (*so->so_proto->pr_ctloutput)
-				    (PRCO_GETOPT, so, level, optname, mp);
+				    (PRCO_GETOPT, so, level, optname, m);
 				NET_UNLOCK(s);
-				return (error);
+				if (error) {
+					(void)m_free(m);
+					return (error);
+				}
+				break;
 			}
+			(void)m_free(m);
 			return (ENOPROTOOPT);
-			break;
 
 #ifdef SOCKET_SPLICE
 		case SO_SPLICE:
@@ -1880,7 +1891,6 @@ sogetopt(struct socket *so, int level, int optname, struct mbuf **mp)
 			}
 			(void)m_free(m);
 			return (EOPNOTSUPP);
-			break;
 
 		default:
 			(void)m_free(m);
diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
index dff6b622a8a..6ae7c1cebef 100644
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rtsock.c,v 1.221 2017/01/31 10:24:41 jca Exp $	*/
+/*	$OpenBSD: rtsock.c,v 1.222 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: rtsock.c,v 1.18 1996/03/29 00:32:10 cgd Exp $	*/
 
 /*
@@ -98,7 +98,7 @@ struct walkarg {
 	caddr_t	w_where, w_tmem;
 };
 
-int	route_ctloutput(int, struct socket *, int, int, struct mbuf **);
+int	route_ctloutput(int, struct socket *, int, int, struct mbuf *);
 void	route_input(struct mbuf *m0, sa_family_t);
 int	route_arp_conflict(struct rtentry *, struct rt_addrinfo *);
 int	route_cleargateway(struct rtentry *, void *, unsigned int);
@@ -234,17 +234,16 @@ route_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
 
 int
 route_ctloutput(int op, struct socket *so, int level, int optname,
-    struct mbuf **mp)
+    struct mbuf *m)
 {
 	struct routecb *rop = sotoroutecb(so);
-	struct mbuf *m = *mp;
 	int error = 0;
 	unsigned int tid;
 
 	if (level != AF_ROUTE) {
 		error = EINVAL;
-		if (op == PRCO_SETOPT && *mp)
-			m_free(*mp);
+		if (op == PRCO_SETOPT && m)
+			m_free(m);
 		return (error);
 	}
 
@@ -277,12 +276,10 @@ route_ctloutput(int op, struct socket *so, int level, int optname,
 	case PRCO_GETOPT:
 		switch (optname) {
 		case ROUTE_MSGFILTER:
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 			m->m_len = sizeof(unsigned int);
 			*mtod(m, unsigned int *) = rop->msgfilter;
 			break;
 		case ROUTE_TABLEFILTER:
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 			m->m_len = sizeof(unsigned int);
 			*mtod(m, unsigned int *) = rop->rtableid;
 			break;
diff --git a/sys/netinet/ip_mroute.c b/sys/netinet/ip_mroute.c
index b282ec2eeeb..5a6a9dc5b78 100644
--- a/sys/netinet/ip_mroute.c
+++ b/sys/netinet/ip_mroute.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_mroute.c,v 1.107 2017/01/12 08:22:42 rzalamena Exp $	*/
+/*	$OpenBSD: ip_mroute.c,v 1.108 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: ip_mroute.c,v 1.85 2004/04/26 01:31:57 matt Exp $	*/
 
 /*
@@ -173,7 +173,7 @@ mfc_find(struct ifnet *ifp, struct in_addr *origin, struct in_addr *group,
  * Handle MRT setsockopt commands to modify the multicast routing tables.
  */
 int
-ip_mrouter_set(struct socket *so, int optname, struct mbuf **mp)
+ip_mrouter_set(struct socket *so, int optname, struct mbuf *m)
 {
 	struct inpcb *inp = sotoinpcb(so);
 	int error;
@@ -184,32 +184,32 @@ ip_mrouter_set(struct socket *so, int optname, struct mbuf **mp)
 	else
 		switch (optname) {
 		case MRT_INIT:
-			error = ip_mrouter_init(so, *mp);
+			error = ip_mrouter_init(so, m);
 			break;
 		case MRT_DONE:
 			error = ip_mrouter_done(so);
 			break;
 		case MRT_ADD_VIF:
-			error = add_vif(so, *mp);
+			error = add_vif(so, m);
 			break;
 		case MRT_DEL_VIF:
-			error = del_vif(so, *mp);
+			error = del_vif(so, m);
 			break;
 		case MRT_ADD_MFC:
-			error = add_mfc(so, *mp);
+			error = add_mfc(so, m);
 			break;
 		case MRT_DEL_MFC:
-			error = del_mfc(so, *mp);
+			error = del_mfc(so, m);
 			break;
 		case MRT_API_CONFIG:
-			error = set_api_config(so, *mp);
+			error = set_api_config(so, m);
 			break;
 		default:
 			error = ENOPROTOOPT;
 			break;
 		}
 
-	m_free(*mp);
+	m_free(m);
 	return (error);
 }
 
@@ -217,7 +217,7 @@ ip_mrouter_set(struct socket *so, int optname, struct mbuf **mp)
  * Handle MRT getsockopt commands
  */
 int
-ip_mrouter_get(struct socket *so, int optname, struct mbuf **mp)
+ip_mrouter_get(struct socket *so, int optname, struct mbuf *m)
 {
 	struct inpcb *inp = sotoinpcb(so);
 	int error;
@@ -225,25 +225,20 @@ ip_mrouter_get(struct socket *so, int optname, struct mbuf **mp)
 	if (so != ip_mrouter[inp->inp_rtableid])
 		error = ENOPROTOOPT;
 	else {
-		*mp = m_get(M_WAIT, MT_SOOPTS);
-
 		switch (optname) {
 		case MRT_VERSION:
-			error = get_version(*mp);
+			error = get_version(m);
 			break;
 		case MRT_API_SUPPORT:
-			error = get_api_support(*mp);
+			error = get_api_support(m);
 			break;
 		case MRT_API_CONFIG:
-			error = get_api_config(*mp);
+			error = get_api_config(m);
 			break;
 		default:
 			error = ENOPROTOOPT;
 			break;
 		}
-
-		if (error)
-			m_free(*mp);
 	}
 
 	return (error);
diff --git a/sys/netinet/ip_mroute.h b/sys/netinet/ip_mroute.h
index 24f8f6f8aeb..ce4506b6b26 100644
--- a/sys/netinet/ip_mroute.h
+++ b/sys/netinet/ip_mroute.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_mroute.h,v 1.27 2017/01/12 08:22:42 rzalamena Exp $	*/
+/*	$OpenBSD: ip_mroute.h,v 1.28 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: ip_mroute.h,v 1.23 2004/04/21 17:49:46 itojun Exp $	*/
 
 #ifndef _NETINET_IP_MROUTE_H_
@@ -223,8 +223,8 @@ struct igmpmsg {
 	struct	  in_addr im_src, im_dst;
 };
 
-int	ip_mrouter_set(struct socket *, int, struct mbuf **);
-int	ip_mrouter_get(struct socket *, int, struct mbuf **);
+int	ip_mrouter_set(struct socket *, int, struct mbuf *);
+int	ip_mrouter_get(struct socket *, int, struct mbuf *);
 int	mrt_ioctl(struct socket *, u_long, caddr_t);
 int	mrt_sysctl_vif(void *, size_t *);
 int	mrt_sysctl_mfc(void *, size_t *);
diff --git a/sys/netinet/ip_output.c b/sys/netinet/ip_output.c
index c1cf4f68cfe..7f276bbf470 100644
--- a/sys/netinet/ip_output.c
+++ b/sys/netinet/ip_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_output.c,v 1.334 2017/01/10 09:01:18 mpi Exp $	*/
+/*	$OpenBSD: ip_output.c,v 1.335 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: ip_output.c,v 1.28 1996/02/13 23:43:07 christos Exp $	*/
 
 /*
@@ -845,10 +845,9 @@ ip_optcopy(struct ip *ip, struct ip *jp)
  */
 int
 ip_ctloutput(int op, struct socket *so, int level, int optname,
-    struct mbuf **mp)
+    struct mbuf *m)
 {
 	struct inpcb *inp = sotoinpcb(so);
-	struct mbuf *m = *mp;
 	int optval = 0;
 	struct proc *p = curproc; /* XXX */
 	int error = 0;
@@ -857,7 +856,7 @@ ip_ctloutput(int op, struct socket *so, int level, int optname,
 	if (level != IPPROTO_IP) {
 		error = EINVAL;
 		if (op == PRCO_SETOPT)
-			(void) m_free(*mp);
+			(void) m_free(m);
 	} else switch (op) {
 	case PRCO_SETOPT:
 		switch (optname) {
@@ -1081,7 +1080,6 @@ ip_ctloutput(int op, struct socket *so, int level, int optname,
 		switch (optname) {
 		case IP_OPTIONS:
 		case IP_RETOPTS:
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 			if (inp->inp_options) {
 				m->m_len = inp->inp_options->m_len;
 				memcpy(mtod(m, caddr_t),
@@ -1102,7 +1100,6 @@ ip_ctloutput(int op, struct socket *so, int level, int optname,
 		case IP_RECVRTABLE:
 		case IP_IPSECFLOWINFO:
 		case IP_IPDEFTTL:
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 			m->m_len = sizeof(int);
 			switch (optname) {
 
@@ -1159,11 +1156,10 @@ ip_ctloutput(int op, struct socket *so, int level, int optname,
 		case IP_MULTICAST_LOOP:
 		case IP_ADD_MEMBERSHIP:
 		case IP_DROP_MEMBERSHIP:
-			error = ip_getmoptions(optname, inp->inp_moptions, mp);
+			error = ip_getmoptions(optname, inp->inp_moptions, m);
 			break;
 
 		case IP_PORTRANGE:
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 			m->m_len = sizeof(int);
 
 			if (inp->inp_flags & INP_HIGHPORT)
@@ -1180,7 +1176,6 @@ ip_ctloutput(int op, struct socket *so, int level, int optname,
 		case IP_ESP_TRANS_LEVEL:
 		case IP_ESP_NETWORK_LEVEL:
 		case IP_IPCOMP_LEVEL:
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 #ifndef IPSEC
 			m->m_len = sizeof(int);
 			*mtod(m, int *) = IPSEC_LEVEL_NONE;
@@ -1210,12 +1205,10 @@ ip_ctloutput(int op, struct socket *so, int level, int optname,
 			error = EOPNOTSUPP;
 			break;
 		case SO_RTABLE:
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 			m->m_len = sizeof(u_int);
 			*mtod(m, u_int *) = inp->inp_rtableid;
 			break;
 		case IP_PIPEX:
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 			m->m_len = sizeof(int);
 			*mtod(m, int *) = inp->inp_pipex;
 			break;
@@ -1624,7 +1617,7 @@ ip_setmoptions(int optname, struct ip_moptions **imop, struct mbuf *m,
  * Return the IP multicast options in response to user getsockopt().
  */
 int
-ip_getmoptions(int optname, struct ip_moptions *imo, struct mbuf **mp)
+ip_getmoptions(int optname, struct ip_moptions *imo, struct mbuf *m)
 {
 	u_char *ttl;
 	u_char *loop;
@@ -1632,13 +1625,11 @@ ip_getmoptions(int optname, struct ip_moptions *imo, struct mbuf **mp)
 	struct in_ifaddr *ia;
 	struct ifnet *ifp;
 
-	*mp = m_get(M_WAIT, MT_SOOPTS);
-
 	switch (optname) {
 
 	case IP_MULTICAST_IF:
-		addr = mtod(*mp, struct in_addr *);
-		(*mp)->m_len = sizeof(struct in_addr);
+		addr = mtod(m, struct in_addr *);
+		m->m_len = sizeof(struct in_addr);
 		if (imo == NULL || (ifp = if_get(imo->imo_ifidx)) == NULL)
 			addr->s_addr = INADDR_ANY;
 		else {
@@ -1650,15 +1641,15 @@ ip_getmoptions(int optname, struct ip_moptions *imo, struct mbuf **mp)
 		return (0);
 
 	case IP_MULTICAST_TTL:
-		ttl = mtod(*mp, u_char *);
-		(*mp)->m_len = 1;
+		ttl = mtod(m, u_char *);
+		m->m_len = 1;
 		*ttl = (imo == NULL) ? IP_DEFAULT_MULTICAST_TTL
 				     : imo->imo_ttl;
 		return (0);
 
 	case IP_MULTICAST_LOOP:
-		loop = mtod(*mp, u_char *);
-		(*mp)->m_len = 1;
+		loop = mtod(m, u_char *);
+		m->m_len = 1;
 		*loop = (imo == NULL) ? IP_DEFAULT_MULTICAST_LOOP
 				      : imo->imo_loop;
 		return (0);
diff --git a/sys/netinet/ip_var.h b/sys/netinet/ip_var.h
index f1fd4e20754..285d64d9402 100644
--- a/sys/netinet/ip_var.h
+++ b/sys/netinet/ip_var.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip_var.h,v 1.67 2017/01/29 19:58:47 bluhm Exp $	*/
+/*	$OpenBSD: ip_var.h,v 1.68 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: ip_var.h,v 1.16 1996/02/13 23:43:20 christos Exp $	*/
 
 /*
@@ -219,13 +219,13 @@ extern struct pool ipqent_pool;
 struct route;
 struct inpcb;
 
-int	 ip_ctloutput(int, struct socket *, int, int, struct mbuf **);
+int	 ip_ctloutput(int, struct socket *, int, int, struct mbuf *);
 void	 ip_drain(void);
 void	 ip_flush(void);
 int	 ip_fragment(struct mbuf *, struct ifnet *, u_long);
 void	 ip_freef(struct ipq *);
 void	 ip_freemoptions(struct ip_moptions *);
-int	 ip_getmoptions(int, struct ip_moptions *, struct mbuf **);
+int	 ip_getmoptions(int, struct ip_moptions *, struct mbuf *);
 void	 ip_init(void);
 struct mbuf*
 	 ip_insertoptions(struct mbuf *, struct mbuf *, int *);
@@ -250,7 +250,7 @@ void	 ip_savecontrol(struct inpcb *, struct mbuf **, struct ip *,
 void	 ipintr(void);
 void	 ipv4_input(struct mbuf *);
 void	 ip_forward(struct mbuf *, struct ifnet *, struct rtentry *, int);
-int	 rip_ctloutput(int, struct socket *, int, int, struct mbuf **);
+int	 rip_ctloutput(int, struct socket *, int, int, struct mbuf *);
 void	 rip_init(void);
 int	 rip_input(struct mbuf **, int *, int);
 int	 rip_output(struct mbuf *, ...);
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index a9d55bfc7ea..b3d0d7acd9e 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip.c,v 1.94 2017/01/29 19:58:47 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip.c,v 1.95 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: raw_ip.c,v 1.25 1996/02/18 18:58:33 christos Exp $	*/
 
 /*
@@ -299,7 +299,7 @@ rip_output(struct mbuf *m, ...)
  */
 int
 rip_ctloutput(int op, struct socket *so, int level, int optname,
-    struct mbuf **mp)
+    struct mbuf *m)
 {
 	struct inpcb *inp = sotoinpcb(so);
 	int error = 0;
@@ -307,7 +307,7 @@ rip_ctloutput(int op, struct socket *so, int level, int optname,
 
 	if (level != IPPROTO_IP) {
 		if (op == PRCO_SETOPT)
-			(void) m_free(*mp);
+			(void) m_free(m);
 		return (EINVAL);
 	}
 
@@ -316,28 +316,27 @@ rip_ctloutput(int op, struct socket *so, int level, int optname,
 	case IP_HDRINCL:
 		error = 0;
 		if (op == PRCO_SETOPT) {
-			if (*mp == NULL || (*mp)->m_len < sizeof (int))
+			if (m == NULL || m->m_len < sizeof (int))
 				error = EINVAL;
-			else if (*mtod(*mp, int *))
+			else if (*mtod(m, int *))
 				inp->inp_flags |= INP_HDRINCL;
 			else
 				inp->inp_flags &= ~INP_HDRINCL;
-			m_free(*mp);
+			m_free(m);
 		} else {
-			*mp = m_get(M_WAIT, M_SOOPTS);
-			(*mp)->m_len = sizeof(int);
-			*mtod(*mp, int *) = inp->inp_flags & INP_HDRINCL;
+			m->m_len = sizeof(int);
+			*mtod(m, int *) = inp->inp_flags & INP_HDRINCL;
 		}
 		return (error);
 
 	case IP_DIVERTFL:
 		switch (op) {
 		case PRCO_SETOPT:
-			if (*mp == NULL || (*mp)->m_len < sizeof (int)) {
+			if (m == NULL || m->m_len < sizeof (int)) {
 				error = EINVAL;
 				break;
 			}
-			dir = *mtod(*mp, int *);
+			dir = *mtod(m, int *);
 			if (inp->inp_divertfl > 0)
 				error = ENOTSUP;
 			else if ((dir & IPPROTO_DIVERT_RESP) ||
@@ -349,9 +348,8 @@ rip_ctloutput(int op, struct socket *so, int level, int optname,
 			break;
 
 		case PRCO_GETOPT:
-			*mp = m_get(M_WAIT, M_SOOPTS);
-			(*mp)->m_len = sizeof(int);
-			*mtod(*mp, int *) = inp->inp_divertfl;
+			m->m_len = sizeof(int);
+			*mtod(m, int *) = inp->inp_divertfl;
 			break;
 
 		default:
@@ -360,7 +358,7 @@ rip_ctloutput(int op, struct socket *so, int level, int optname,
 		}
 
 		if (op == PRCO_SETOPT)
-			(void)m_free(*mp);
+			(void)m_free(m);
 		return (error);
 
 	case MRT_INIT:
@@ -376,10 +374,10 @@ rip_ctloutput(int op, struct socket *so, int level, int optname,
 #ifdef MROUTING
 		switch (op) {
 		case PRCO_SETOPT:
-			error = ip_mrouter_set(so, optname, mp);
+			error = ip_mrouter_set(so, optname, m);
 			break;
 		case PRCO_GETOPT:
-			error = ip_mrouter_get(so, optname, mp);
+			error = ip_mrouter_get(so, optname, m);
 			break;
 		default:
 			error = EINVAL;
@@ -388,11 +386,11 @@ rip_ctloutput(int op, struct socket *so, int level, int optname,
 		return (error);
 #else
 		if (op == PRCO_SETOPT)
-			m_free(*mp);
+			m_free(m);
 		return (EOPNOTSUPP);
 #endif
 	}
-	return (ip_ctloutput(op, so, level, optname, mp));
+	return (ip_ctloutput(op, so, level, optname, m));
 }
 
 u_long	rip_sendspace = RIPSNDQ;
diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c
index fca2b4ad67f..9a6d1376d4c 100644
--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcp_usrreq.c,v 1.142 2017/01/10 09:01:18 mpi Exp $	*/
+/*	$OpenBSD: tcp_usrreq.c,v 1.143 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: tcp_usrreq.c,v 1.20 1996/02/13 23:44:16 christos Exp $	*/
 
 /*
@@ -449,29 +449,28 @@ tcp_usrreq(struct socket *so, int req, struct mbuf *m, struct mbuf *nam,
 
 int
 tcp_ctloutput(int op, struct socket *so, int level, int optname,
-    struct mbuf **mp)
+    struct mbuf *m)
 {
 	int error = 0;
 	struct inpcb *inp;
 	struct tcpcb *tp;
-	struct mbuf *m;
 	int i;
 
 	inp = sotoinpcb(so);
 	if (inp == NULL) {
 		if (op == PRCO_SETOPT)
-			(void) m_free(*mp);
+			(void) m_free(m);
 		return (ECONNRESET);
 	}
 	if (level != IPPROTO_TCP) {
 		switch (so->so_proto->pr_domain->dom_family) {
 #ifdef INET6
 		case PF_INET6:
-			error = ip6_ctloutput(op, so, level, optname, mp);
+			error = ip6_ctloutput(op, so, level, optname, m);
 			break;
 #endif /* INET6 */
 		case PF_INET:
-			error = ip_ctloutput(op, so, level, optname, mp);
+			error = ip_ctloutput(op, so, level, optname, m);
 			break;
 		default:
 			error = EAFNOSUPPORT;	/*?*/
@@ -484,7 +483,6 @@ tcp_ctloutput(int op, struct socket *so, int level, int optname,
 	switch (op) {
 
 	case PRCO_SETOPT:
-		m = *mp;
 		switch (optname) {
 
 		case TCP_NODELAY:
@@ -573,7 +571,6 @@ tcp_ctloutput(int op, struct socket *so, int level, int optname,
 		break;
 
 	case PRCO_GETOPT:
-		*mp = m = m_get(M_WAIT, MT_SOOPTS);
 		m->m_len = sizeof(int);
 
 		switch (optname) {
diff --git a/sys/netinet/tcp_var.h b/sys/netinet/tcp_var.h
index fdf468af7d5..e04a16f7b31 100644
--- a/sys/netinet/tcp_var.h
+++ b/sys/netinet/tcp_var.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcp_var.h,v 1.120 2017/01/29 19:58:47 bluhm Exp $	*/
+/*	$OpenBSD: tcp_var.h,v 1.121 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: tcp_var.h,v 1.17 1996/02/13 23:44:24 christos Exp $	*/
 
 /*
@@ -602,7 +602,7 @@ int	 tcp_freeq(struct tcpcb *);
 void	 tcp6_ctlinput(int, struct sockaddr *, u_int, void *);
 #endif
 void	 tcp_ctlinput(int, struct sockaddr *, u_int, void *);
-int	 tcp_ctloutput(int, struct socket *, int, int, struct mbuf **);
+int	 tcp_ctloutput(int, struct socket *, int, int, struct mbuf *);
 struct tcpcb *
 	 tcp_disconnect(struct tcpcb *);
 struct tcpcb *
diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c
index 807cdae021f..5041109341c 100644
--- a/sys/netinet6/icmp6.c
+++ b/sys/netinet6/icmp6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: icmp6.c,v 1.197 2017/01/19 14:49:19 bluhm Exp $	*/
+/*	$OpenBSD: icmp6.c,v 1.198 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$KAME: icmp6.c,v 1.217 2001/06/20 15:03:29 jinmei Exp $	*/
 
 /*
@@ -1802,11 +1802,10 @@ fail:
  */
 int
 icmp6_ctloutput(int op, struct socket *so, int level, int optname,
-    struct mbuf **mp)
+    struct mbuf *m)
 {
 	int error = 0;
 	struct inpcb *in6p = sotoinpcb(so);
-	struct mbuf *m = *mp;
 
 	if (level != IPPROTO_ICMPV6) {
 		if (op == PRCO_SETOPT)
@@ -1853,7 +1852,6 @@ icmp6_ctloutput(int op, struct socket *so, int level, int optname,
 				error = EINVAL;
 				break;
 			}
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 			m->m_len = sizeof(struct icmp6_filter);
 			p = mtod(m, struct icmp6_filter *);
 			bcopy(in6p->inp_icmp6filt, p,
diff --git a/sys/netinet6/ip6_mroute.c b/sys/netinet6/ip6_mroute.c
index c91accd4d64..0abe20f8094 100644
--- a/sys/netinet6/ip6_mroute.c
+++ b/sys/netinet6/ip6_mroute.c
@@ -245,13 +245,11 @@ ip6_mrouter_set(int cmd, struct socket *so, struct mbuf *m)
  * Handle MRT getsockopt commands
  */
 int
-ip6_mrouter_get(int cmd, struct socket *so, struct mbuf **mp)
+ip6_mrouter_get(int cmd, struct socket *so, struct mbuf *m)
 {
 	if (so != ip6_mrouter)
 		return (EPERM);
 
-	*mp = m_get(M_WAIT, MT_SOOPTS);
-
 	switch (cmd) {
 	default:
 		return EOPNOTSUPP;
diff --git a/sys/netinet6/ip6_mroute.h b/sys/netinet6/ip6_mroute.h
index 5b1d7df7f50..70407f560ba 100644
--- a/sys/netinet6/ip6_mroute.h
+++ b/sys/netinet6/ip6_mroute.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip6_mroute.h,v 1.17 2016/12/22 11:04:44 rzalamena Exp $	*/
+/*	$OpenBSD: ip6_mroute.h,v 1.18 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$KAME: ip6_mroute.h,v 1.17 2001/02/10 02:05:52 itojun Exp $	*/
 
 /*
@@ -247,7 +247,7 @@ struct rtdetq {		/* XXX: rtdetq is also defined in ip_mroute.h */
 #define MAX_UPQ6	4		/* max. no of pkts in upcall Q */
 
 int	ip6_mrouter_set(int, struct socket *, struct mbuf *);
-int	ip6_mrouter_get(int, struct socket *, struct mbuf **);
+int	ip6_mrouter_get(int, struct socket *, struct mbuf *);
 int	ip6_mrouter_done(void);
 void	ip6_mrouter_detach(struct ifnet *);
 int	mrt6_ioctl(u_long, caddr_t);
diff --git a/sys/netinet6/ip6_output.c b/sys/netinet6/ip6_output.c
index 4c92315eae0..9d35a8a4c5d 100644
--- a/sys/netinet6/ip6_output.c
+++ b/sys/netinet6/ip6_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip6_output.c,v 1.222 2017/01/27 02:55:36 dhill Exp $	*/
+/*	$OpenBSD: ip6_output.c,v 1.223 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $	*/
 
 /*
@@ -117,10 +117,10 @@ struct ip6_exthdrs {
 };
 
 int ip6_pcbopt(int, u_char *, int, struct ip6_pktopts **, int, int);
-int ip6_getpcbopt(struct ip6_pktopts *, int, struct mbuf **);
+int ip6_getpcbopt(struct ip6_pktopts *, int, struct mbuf *);
 int ip6_setpktopt(int, u_char *, int, struct ip6_pktopts *, int, int, int);
 int ip6_setmoptions(int, struct ip6_moptions **, struct mbuf *);
-int ip6_getmoptions(int, struct ip6_moptions *, struct mbuf **);
+int ip6_getmoptions(int, struct ip6_moptions *, struct mbuf *);
 int ip6_copyexthdr(struct mbuf **, caddr_t, int);
 int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
 	struct ip6_frag **);
@@ -1048,12 +1048,11 @@ ip6_getpmtu(struct rtentry *rt, struct ifnet *ifp, u_long *mtup)
  */
 int
 ip6_ctloutput(int op, struct socket *so, int level, int optname,
-    struct mbuf **mp)
+    struct mbuf *m)
 {
 	int privileged, optdatalen, uproto;
 	void *optdata;
 	struct inpcb *inp = sotoinpcb(so);
-	struct mbuf *m = *mp;
 	int error, optval;
 	struct proc *p = curproc; /* For IPSec and rdomain */
 	u_int rtid = 0;
@@ -1475,7 +1474,6 @@ do { \
 				}
 				if (error)
 					break;
-				*mp = m = m_get(M_WAIT, MT_SOOPTS);
 				m->m_len = sizeof(int);
 				*mtod(m, int *) = optval;
 				break;
@@ -1515,7 +1513,6 @@ do { \
 				optdatalen = sizeof(mtuinfo);
 				if (optdatalen > MCLBYTES)
 					return (EMSGSIZE); /* XXX */
-				*mp = m = m_get(M_WAIT, MT_SOOPTS);
 				if (optdatalen > MLEN)
 					MCLGET(m, M_WAIT);
 				m->m_len = optdatalen;
@@ -1532,7 +1529,7 @@ do { \
 			case IPV6_DONTFRAG:
 			case IPV6_USE_MIN_MTU:
 				error = ip6_getpcbopt(inp->inp_outputopts6,
-				    optname, mp);
+				    optname, m);
 				break;
 
 			case IPV6_MULTICAST_IF:
@@ -1541,7 +1538,7 @@ do { \
 			case IPV6_JOIN_GROUP:
 			case IPV6_LEAVE_GROUP:
 				error = ip6_getmoptions(optname,
-				    inp->inp_moptions6, mp);
+				    inp->inp_moptions6, m);
 				break;
 
 			case IPSEC6_OUTSA:
@@ -1552,7 +1549,6 @@ do { \
 			case IPV6_ESP_TRANS_LEVEL:
 			case IPV6_ESP_NETWORK_LEVEL:
 			case IPV6_IPCOMP_LEVEL:
-				*mp = m = m_get(M_WAIT, MT_SOOPTS);
 #ifndef IPSEC
 				m->m_len = sizeof(int);
 				*mtod(m, int *) = IPSEC_LEVEL_NONE;
@@ -1581,12 +1577,10 @@ do { \
 #endif
 				break;
 			case SO_RTABLE:
-				*mp = m = m_get(M_WAIT, MT_SOOPTS);
 				m->m_len = sizeof(u_int);
 				*mtod(m, u_int *) = optval;
 				break;
 			case IPV6_PIPEX:
-				*mp = m = m_get(M_WAIT, MT_SOOPTS);
 				m->m_len = sizeof(int);
 				*mtod(m, int *) = optval;
 				break;
@@ -1600,23 +1594,22 @@ do { \
 	} else {
 		error = EINVAL;
 		if (op == PRCO_SETOPT)
-			(void)m_free(*mp);
+			(void)m_free(m);
 	}
 	return (error);
 }
 
 int
 ip6_raw_ctloutput(int op, struct socket *so, int level, int optname,
-    struct mbuf **mp)
+    struct mbuf *m)
 {
 	int error = 0, optval;
 	const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
 	struct inpcb *inp = sotoinpcb(so);
-	struct mbuf *m = *mp;
 
 	if (level != IPPROTO_IPV6) {
 		if (op == PRCO_SETOPT)
-			(void)m_free(*mp);
+			(void)m_free(m);
 		return (EINVAL);
 	}
 
@@ -1653,7 +1646,6 @@ ip6_raw_ctloutput(int op, struct socket *so, int level, int optname,
 			else
 				optval = inp->inp_cksum6;
 
-			*mp = m = m_get(M_WAIT, MT_SOOPTS);
 			m->m_len = sizeof(int);
 			*mtod(m, int *) = optval;
 			break;
@@ -1682,7 +1674,6 @@ ip6_raw_ctloutput(int op, struct socket *so, int level, int optname,
 void
 ip6_initpktopts(struct ip6_pktopts *opt)
 {
-
 	bzero(opt, sizeof(*opt));
 	opt->ip6po_hlim = -1;	/* -1 means default hop limit */
 	opt->ip6po_tclass = -1;	/* -1 means default traffic class */
@@ -1706,7 +1697,7 @@ ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
 }
 
 int
-ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct mbuf **mp)
+ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct mbuf *m)
 {
 	void *optdata = NULL;
 	int optdatalen = 0;
@@ -1715,7 +1706,6 @@ ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct mbuf **mp)
 	struct in6_pktinfo null_pktinfo;
 	int deftclass = 0, on;
 	int defminmtu = IP6PO_MINMTU_MCASTONLY;
-	struct mbuf *m;
 
 	switch (optname) {
 	case IPV6_PKTINFO:
@@ -1787,7 +1777,6 @@ ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct mbuf **mp)
 
 	if (optdatalen > MCLBYTES)
 		return (EMSGSIZE); /* XXX */
-	*mp = m = m_get(M_WAIT, MT_SOOPTS);
 	if (optdatalen > MLEN)
 		MCLGET(m, M_WAIT);
 	m->m_len = optdatalen;
@@ -2169,17 +2158,14 @@ ip6_setmoptions(int optname, struct ip6_moptions **im6op, struct mbuf *m)
  * Return the IP6 multicast options in response to user getsockopt().
  */
 int
-ip6_getmoptions(int optname, struct ip6_moptions *im6o, struct mbuf **mp)
+ip6_getmoptions(int optname, struct ip6_moptions *im6o, struct mbuf *m)
 {
 	u_int *hlim, *loop, *ifindex;
 
-	*mp = m_get(M_WAIT, MT_SOOPTS);
-
 	switch (optname) {
-
 	case IPV6_MULTICAST_IF:
-		ifindex = mtod(*mp, u_int *);
-		(*mp)->m_len = sizeof(u_int);
+		ifindex = mtod(m, u_int *);
+		m->m_len = sizeof(u_int);
 		if (im6o == NULL || im6o->im6o_ifidx == 0)
 			*ifindex = 0;
 		else
@@ -2187,8 +2173,8 @@ ip6_getmoptions(int optname, struct ip6_moptions *im6o, struct mbuf **mp)
 		return (0);
 
 	case IPV6_MULTICAST_HOPS:
-		hlim = mtod(*mp, u_int *);
-		(*mp)->m_len = sizeof(u_int);
+		hlim = mtod(m, u_int *);
+		m->m_len = sizeof(u_int);
 		if (im6o == NULL)
 			*hlim = ip6_defmcasthlim;
 		else
@@ -2196,8 +2182,8 @@ ip6_getmoptions(int optname, struct ip6_moptions *im6o, struct mbuf **mp)
 		return (0);
 
 	case IPV6_MULTICAST_LOOP:
-		loop = mtod(*mp, u_int *);
-		(*mp)->m_len = sizeof(u_int);
+		loop = mtod(m, u_int *);
+		m->m_len = sizeof(u_int);
 		if (im6o == NULL)
 			*loop = ip6_defmcasthlim;
 		else
diff --git a/sys/netinet6/ip6_var.h b/sys/netinet6/ip6_var.h
index a7e1fefb682..11ff0524bd3 100644
--- a/sys/netinet6/ip6_var.h
+++ b/sys/netinet6/ip6_var.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ip6_var.h,v 1.65 2016/12/02 11:16:04 mpi Exp $	*/
+/*	$OpenBSD: ip6_var.h,v 1.66 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$KAME: ip6_var.h,v 1.33 2000/06/11 14:59:20 jinmei Exp $	*/
 
 /*
@@ -241,7 +241,7 @@ extern int ip6_auto_linklocal;
 struct in6pcb;
 struct inpcb;
 
-int	icmp6_ctloutput(int, struct socket *, int, int, struct mbuf **);
+int	icmp6_ctloutput(int, struct socket *, int, int, struct mbuf *);
 
 void	ip6_init(void);
 void	ip6intr(void);
@@ -264,8 +264,8 @@ void	ip6_mloopback(struct ifnet *, struct mbuf *, struct sockaddr_in6 *);
 int	ip6_output(struct mbuf *, struct ip6_pktopts *, struct route_in6 *, int,
 	    struct ip6_moptions *, struct inpcb *);
 int	ip6_fragment(struct mbuf *, int, u_char, u_long);
-int	ip6_ctloutput(int, struct socket *, int, int, struct mbuf **);
-int	ip6_raw_ctloutput(int, struct socket *, int, int, struct mbuf **);
+int	ip6_ctloutput(int, struct socket *, int, int, struct mbuf *);
+int	ip6_raw_ctloutput(int, struct socket *, int, int, struct mbuf *);
 void	ip6_initpktopts(struct ip6_pktopts *);
 int	ip6_setpktopts(struct mbuf *, struct ip6_pktopts *,
 	    struct ip6_pktopts *, int, int);
@@ -285,7 +285,7 @@ void	frag6_drain(void);
 void	rip6_init(void);
 int	rip6_input(struct mbuf **mp, int *offp, int proto);
 void	rip6_ctlinput(int, struct sockaddr *, u_int, void *);
-int	rip6_ctloutput(int, struct socket *, int, int, struct mbuf **);
+int	rip6_ctloutput(int, struct socket *, int, int, struct mbuf *);
 int	rip6_output(struct mbuf *, ...);
 int	rip6_usrreq(struct socket *,
 	    int, struct mbuf *, struct mbuf *, struct mbuf *, struct proc *);
diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c
index 9b217f42aa1..c9da7afb9ba 100644
--- a/sys/netinet6/raw_ip6.c
+++ b/sys/netinet6/raw_ip6.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: raw_ip6.c,v 1.103 2017/01/23 16:31:24 bluhm Exp $	*/
+/*	$OpenBSD: raw_ip6.c,v 1.104 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$KAME: raw_ip6.c,v 1.69 2001/03/04 15:55:44 itojun Exp $	*/
 
 /*
@@ -474,7 +474,7 @@ rip6_output(struct mbuf *m, ...)
  */
 int
 rip6_ctloutput(int op, struct socket *so, int level, int optname,
-	struct mbuf **mp)
+    struct mbuf *m)
 {
 	struct inpcb *inp = sotoinpcb(so);
 	int error = 0;
@@ -487,11 +487,11 @@ rip6_ctloutput(int op, struct socket *so, int level, int optname,
 		case IP_DIVERTFL:
 			switch (op) {
 			case PRCO_SETOPT:
-				if (*mp == NULL || (*mp)->m_len < sizeof(int)) {
+				if (m == NULL || m->m_len < sizeof(int)) {
 					error = EINVAL;
 					break;
 				}
-				dir = *mtod(*mp, int *);
+				dir = *mtod(m, int *);
 				if (inp->inp_divertfl > 0)
 					error = ENOTSUP;
 				else if ((dir & IPPROTO_DIVERT_RESP) ||
@@ -502,9 +502,8 @@ rip6_ctloutput(int op, struct socket *so, int level, int optname,
 				break;
 
 			case PRCO_GETOPT:
-				*mp = m_get(M_WAIT, M_SOOPTS);
-				(*mp)->m_len = sizeof(int);
-				*mtod(*mp, int *) = inp->inp_divertfl;
+				m->m_len = sizeof(int);
+				*mtod(m, int *) = inp->inp_divertfl;
 				break;
 
 			default:
@@ -513,7 +512,7 @@ rip6_ctloutput(int op, struct socket *so, int level, int optname,
 			}
 
 			if (op == PRCO_SETOPT)
-				(void)m_free(*mp);
+				(void)m_free(m);
 			return (error);
 
 #ifdef MROUTING
@@ -524,18 +523,18 @@ rip6_ctloutput(int op, struct socket *so, int level, int optname,
 		case MRT6_ADD_MFC:
 		case MRT6_DEL_MFC:
 			if (op == PRCO_SETOPT) {
-				error = ip6_mrouter_set(optname, so, *mp);
-				m_free(*mp);
+				error = ip6_mrouter_set(optname, so, m);
+				m_free(m);
 			} else if (op == PRCO_GETOPT)
-				error = ip6_mrouter_get(optname, so, mp);
+				error = ip6_mrouter_get(optname, so, m);
 			else
 				error = EINVAL;
 			return (error);
 #endif
 		case IPV6_CHECKSUM:
-			return (ip6_raw_ctloutput(op, so, level, optname, mp));
+			return (ip6_raw_ctloutput(op, so, level, optname, m));
 		default:
-			return (ip6_ctloutput(op, so, level, optname, mp));
+			return (ip6_ctloutput(op, so, level, optname, m));
 		}
 
 	case IPPROTO_ICMPV6:
@@ -543,11 +542,11 @@ rip6_ctloutput(int op, struct socket *so, int level, int optname,
 		 * XXX: is it better to call icmp6_ctloutput() directly
 		 * from protosw?
 		 */
-		return (icmp6_ctloutput(op, so, level, optname, mp));
+		return (icmp6_ctloutput(op, so, level, optname, m));
 
 	default:
 		if (op == PRCO_SETOPT)
-			m_free(*mp);
+			m_free(m);
 		return EINVAL;
 	}
 }
diff --git a/sys/sys/protosw.h b/sys/sys/protosw.h
index 2bc8a45329e..1b300953e1e 100644
--- a/sys/sys/protosw.h
+++ b/sys/sys/protosw.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: protosw.h,v 1.21 2017/01/29 19:58:47 bluhm Exp $	*/
+/*	$OpenBSD: protosw.h,v 1.22 2017/02/01 20:59:47 dhill Exp $	*/
 /*	$NetBSD: protosw.h,v 1.10 1996/04/09 20:55:32 cgd Exp $	*/
 
 /*-
@@ -75,7 +75,7 @@ struct protosw {
 					/* control input (from below) */
 	void	(*pr_ctlinput)(int, struct sockaddr *, u_int, void *);
 					/* control output (from above) */
-	int	(*pr_ctloutput)(int, struct socket *, int, int, struct mbuf **);
+	int	(*pr_ctloutput)(int, struct socket *, int, int, struct mbuf *);
 
 /* user-protocol hook */
 					/* user request: see list below */
-- 
cgit v1.2.3