3 files changed, 15 insertions, 0 deletions

diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index a58b4ca583a7..54a0560a8788 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -3235,6 +3235,10 @@ tcp_timewait(tw, to, th, m, tlen)
 	const int isipv6 = 0;
 #endif
 
+	/* tcbinfo lock required for tcp_twclose(), tcp_2msl_reset. */
+	INP_INFO_WLOCK_ASSERT(&tcbinfo);
+	INP_LOCK_ASSERT(tw->tw_inpcb);
+
 	thflags = th->th_flags;
 
 	/*
diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
index 91841aeca5d4..23dbfa803b9a 100644
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -1642,6 +1642,7 @@ tcp_twstart(tp)
 	int tw_time, acknow;
 	struct socket *so;
 
+	INP_INFO_WLOCK_ASSERT(&tcbinfo);	/* tcp_timer_2msl_reset(). */
 	INP_LOCK_ASSERT(tp->t_inpcb);
 
 	tw = uma_zalloc(tcptw_zone, M_NOWAIT);
@@ -1749,6 +1750,7 @@ tcp_twclose(struct tcptw *tw, int reuse)
 	struct inpcb *inp;
 
 	inp = tw->tw_inpcb;
+	INP_INFO_WLOCK_ASSERT(&tcbinfo);	/* tcp_timer_2msl_stop(). */
 	INP_LOCK_ASSERT(inp);
 
 	tw->tw_inpcb = NULL;
diff --git a/sys/netinet/tcp_timer.c b/sys/netinet/tcp_timer.c
index 420dedfc4817..f83a96d65a80 100644
--- a/sys/netinet/tcp_timer.c
+++ b/sys/netinet/tcp_timer.c
@@ -246,6 +246,12 @@ tcp_timer_2msl(xtp)
 	INP_INFO_WUNLOCK(&tcbinfo);
 }
 
+/*
+ * The timed wait lists contain references to each of the TCP sessions
+ * currently TIME_WAIT state.  The list pointers, including the list pointers
+ * in each tcptw structure, are protected using the global tcbinfo lock,
+ * which must be held over list iteration and modification.
+ */
 struct twlist {
 	LIST_HEAD(, tcptw)	tw_list;
 	struct tcptw	tw_tail;
@@ -273,6 +279,7 @@ tcp_timer_2msl_reset(struct tcptw *tw, int timeo)
 	int i;
 	struct tcptw *tw_tail;
 
+	INP_INFO_WLOCK_ASSERT(&tcbinfo);
 	if (tw->tw_time != 0)
 		LIST_REMOVE(tw, tw_2msl);
 	tw->tw_time = timeo + ticks;
@@ -285,6 +292,7 @@ void
 tcp_timer_2msl_stop(struct tcptw *tw)
 {
 
+	INP_INFO_WLOCK_ASSERT(&tcbinfo);
 	if (tw->tw_time != 0)
 		LIST_REMOVE(tw, tw_2msl);
 }
@@ -296,6 +304,7 @@ tcp_timer_2msl_tw(int reuse)
 	struct twlist *twl;
 	int i;
 
+	INP_INFO_WLOCK_ASSERT(&tcbinfo);
 	for (i = 0; i < 2; i++) {
 		twl = tw_2msl_list[i];
 		tw_tail = &twl->tw_tail;